Almeida Law Group is investigating a data breach at Harbor Developmental Disabilities Foundation (d/b/a Harbor Regional Center). The breach occurred on March 6th, 2026. If you were affected, contact Almeida Law Group.
About Harbor Developmental Disabilities Foundation (d/b/a Harbor Regional Center)
Harbor Developmental Disabilities Foundation, doing business as Harbor Regional Center, is a private nonprofit organization based in Torrance, California that has operated since 1973. It is one of 21 Regional Centers in California that contract with the California Department of Developmental Services to coordinate services for individuals with developmental disabilities. The organization serves more than 20,000 children and adults with intellectual and developmental disabilities and their families across the Bellflower, Harbor, Long Beach, and Torrance Health Districts of Los Angeles County. Because Harbor Regional Center works with a vulnerable population and administers services such as diagnosis, eligibility assessment, early intervention, and service coordination, it handles sensitive personal information about the individuals and families in its care.
What Happened?
Harbor Developmental Disabilities Foundation (d/b/a Harbor Regional Center) was listed in a California Attorney General sample breach notice filed under record ID sb24-626408. On or about March 7th, 2026, Harbor detected unusual activity in its network environment. Its investigation, conducted with the help of legal counsel and third-party forensic specialists, confirmed that an unauthorized individual may have accessed or copied certain information on March 6th and 7th, 2026. Harbor completed its review of the affected data on July 7th, 2026—approximately four months after the incident—and sent notification letters on July 13th, 2026. The notice does not specify which data types were involved; that field is blank in the filing. Harbor states it is not aware of any actual or attempted misuse of the information. The organization is offering 12 months of single-bureau credit monitoring, a credit report, and a credit score at no charge through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of July 13th, 2026.
This March 2026 network intrusion is a separate, second incident from an earlier breach Harbor disclosed in late 2025. That prior breach involved unauthorized access to a single employee email account, detected on September 2nd, 2025 and confirmed on September 29th, 2025, and reportedly affected nearly 36,000 individuals. Law firms including The Lyon Firm and Shamis & Gentile P.A. have opened investigations into Harbor Regional Center’s breaches, with The Lyon Firm citing potential claims under the California Confidentiality of Medical Information Act and the California Consumer Privacy Act. No filed class action lawsuit has been reported specifically for the March 2026 incident as of available reporting. No ransomware group has publicly claimed responsibility for this specific intrusion, though the California Regional Center sector has been actively targeted—a similar organization, North Los Angeles County Regional Center, suffered a Medusa ransomware attack in November 2024.
Key Facts at a Glance
- Company or Organization: Harbor Developmental Disabilities Foundation (d/b/a Harbor Regional Center)
- Industry: Developmental Disability Services / Social Services (nonprofit, state-contracted)
- Location: Torrance, California (Los Angeles County)
- Incident type: Unauthorized access to network environment
- Date of breach: March 6th, 2026
- Date breach discovered: March 7th, 2026
- Date of consumer notification: July 13th, 2026
- Identity theft protection offered: 12 months of single-bureau credit monitoring, credit report, and credit score through Cyberscout (a TransUnion company)
- Enrollment deadline: 90 days from July 13th, 2026
- Prior breach: Yes — a separate September 2025 email account compromise reportedly affecting nearly 36,000 individuals
- Litigation status: Investigation-stage only; The Lyon Firm and Shamis & Gentile P.A. are investigating potential claims; no class action filed for the March 2026 incident as of available reporting
- Source: California Attorney General sample breach notice (https://oag.ca.gov/ecrime/databreach/reports/sb24-626408); HIPAA Journal (https://www.hipaajournal.com/rockhill-womens-care-harbor-regional-center-announced-data-breaches/); The Lyon Firm (https://thelyonfirm.com/blog/harbor-regional-center-data-breach-investigation/)
What Should You Do?
If you received a notice from Harbor Regional Center, enroll in the free credit monitoring offered through Cyberscout at https://bfs.cyberscout.com/activate using the unique code provided in your letter—you must enroll within 90 days of July 13th, 2026. Beyond that, you can place a free fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to make it harder for someone to open new accounts in your name. Review your account statements and check your credit reports at AnnualCreditReport.com for any suspicious or unauthorized activity. If you believe your information has already been misused, visit IdentityTheft.gov to report it and get a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
