$1.8 Million Settlement Reached Following CDCR Data Breach
In January 2022, the California Department of Corrections and Rehabilitation (CDCR) reported that unidentified hackers breached its computer systems, exposing sensitive information of some 236,000 state prisoners and parolees. On April 25, 2025, a Sacramento state court gave final approval to a $1.8 million settlement of a class-action suit filed on behalf of those whose personal information was exposed in the breach.
The data included both personally identifiable information (PII) and protected health information (PHI)—such as the results of COVID-19 testing conducted from June 2020 to January 2022. In addition, information was exposed from the Mental Health Services Delivery System dating back to 2008 about prisoners suffering from mental health issues. CDCR said that other information was potentially exposed, as well, from the Trust, Restitution, Accounting, and Canteen System (TRACS).
After the breach was reported to the Department of Health and Human Services Office for Civil Rights, CDCR officials investigated and reported finding no evidence that any of the data was stolen. But they admitted that it was impossible to discern whether any of the information was subjected to unauthorized access.
A complaint filed in state Superior Court for Sacramento County by prisoner William Henry “Billy” Thomas was granted class-action status. Proceeding on behalf of himself and all others similarly situated, he claimed that CDCR maintained insufficient protections for its systems to prevent unauthorized access to sensitive personal data. The Class was appointed counsel from attorneys with Cole & Van Note in Oakland. The parties proceeded to reach their settlement agreement, which the court granted preliminary approval in September 2024.
Under its terms, up to $690,000 of the $1.8 million settlement fund was set aside for claims administrator CPT Group. Another $630,000 was earmarked for Class Counsel’s fees, plus $10,682.69 for costs. Four service awards of $2,500 each were also designated for Thomas and fellow Plaintiffs Andre Brown, Darrell Denson and Joseph Williams. The balance, estimated at $459,317.31, was divided equally among Class members. Most—236,211 of them—received notice by postcard, with the ability to opt out by filing a form with the court by February 14, 2025; that was also the deadline for anyone to file a claim, though all Class members notified by postcard were included unless they opted out by that date. See: Thomas v. Calif. Dep’t of Corr. & Rehab., Cal. Super. (Cty. of Sacramento), Case No. 34-2022-00328693.
As a digital subscriber to Prison Legal News, you can access full text and downloads for this and other premium content.
Already a subscriber? Login
Related legal case
Thomas v. Calif. Dep’t of Corr. & Rehab
| Cite | Cal. Super. (Cty. of Sacramento), Case No. 34-2022-00328693 |
|---|