Surplus Line Association of California Data Breach Investigation

Data Breach Blog

Data Breach

Surplus Line Association of California Data Breach Investigation

Almeida Law Group Calendar Icon

Date of data breach:

July 13, 2026

by: Almeida Law Group

Almeida Law Group is investigating a data breach at Surplus Line Association of California. The breach occurred on April 4th, 2026. If you were affected, contact Almeida Law Group.

About Surplus Line Association of California

The Surplus Line Association of California (SLA) is a private, 501(c)(6) not-for-profit organization based in San Ramon, California, that serves as the statutory surplus line advisory organization to the California Department of Insurance. Founded in 1937 and formally appointed by the Insurance Commissioner in 1994, the SLA oversees California’s surplus lines insurance marketplace, reviews and processes over one million policy transactions annually, provides compliance tools and continuing education courses, and monitors insurer financial stability. The SLA does not sell insurance—it facilitates regulatory compliance and market oversight for brokers placing unique or hard-to-place risks.

What Happened?

Surplus Line Association of California was listed in a California Attorney General sample breach notice filed on July 13th, 2026. According to the notice, on or around April 14th, 2026, the SLA detected suspicious activity within its network environment and launched an investigation with the help of independent cybersecurity specialists. The investigation determined that certain files were accessed and acquired without authorization on April 4th, 2026. A third-party vendor completed a comprehensive review of those files on June 15th, 2026, confirming that personal information was contained within the affected data. The information involved included first and last name and Social Security numbers. The SLA notified both the California Department of Insurance and the FBI, and reported the incident to the Vermont and Massachusetts attorneys general as well. No ransomware group or specific threat actor has been publicly attributed to this incident.

As of July 14th, 2026, two law firms—Federman & Sherwood and Shamis & Gentile P.A.—are investigating the breach and evaluating potential legal claims on behalf of affected individuals. No lawsuit has been filed yet.

Key Facts at a Glance

  • Company or Organization: Surplus Line Association of California
  • Industry: Insurance regulatory/advisory nonprofit (surplus lines insurance marketplace oversight)
  • Location: San Ramon, CA 94583
  • Incident type: Unauthorized access and acquisition of files
  • Date of breach: April 4th, 2026
  • Date breach discovered: April 14th, 2026
  • Date of consumer notification: July 13th, 2026
  • Identity theft protection offered: 12-month credit monitoring and $1,000,000 identity theft insurance policy through Cyberscout (a TransUnion company)
  • Enrollment deadline: 90 days from the date of the notice letter
  • Litigation status: Federman & Sherwood and Shamis & Gentile P.A. are investigating; no lawsuit filed yet
  • Source: California Attorney General sample breach notice; Federman & Sherwood Investigation; Shamis & Gentile via Claim Depot

What Should You Do?

If you received a notice from Surplus Line Association of California, enroll in the complimentary 12-month credit monitoring and identity theft protection offered through Cyberscout at bfs.cyberscout.com/activate using the unique code provided in your letter—remember you have 90 days from the date of that letter to enroll. Because Social Security numbers were involved, you should also consider placing a fraud alert or a credit freeze with all three major credit bureaus (Equifax, Experian, and TransUnion) to help prevent new accounts from being opened in your name. Review your credit reports closely by visiting AnnualCreditReport.com, where you can request a free report from each bureau. Monitor your bank and financial account statements for any unusual activity, and report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov.

Your Legal Rights

If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.

Were You a Victim of a Data Breach?

"*" indicates required fields

By clicking the SEND button and submitting this form, I consent to receive communications from Almeida Law Group LLC and their co-counsel by phone call, email, and/or SMS regarding this matter and other potential legal matters. I understand that message and data rates may apply and that consent to such contact is not required for use of these services. Message frequency varies. Reply STOP to opt-out and HELP for help. I also agree to the Privacy Policy. I understand that my information may be shared with advertising partners to deliver targeted advertisements and optimize outreach efforts. I confirm that I am at least 18 years old. I have read and understand the disclaimer above. I agree my use of this site and the information provided here is not intended to create and does not create an attorney client relationship with the Almeida Law Group and/or attorneys employed by the Firm. No attorney client relationship is intended or created unless and until an engagement agreement is signed by all relevant parties. The contents of this site constitute attorney advertising and not legal advice; therefore you should not act or rely upon any information contained herein, and should always seek the advice of an attorney.

Resourceful. Resilient. Relentless.

Contact us today to get the justice you and your family deserve.