- Date
- 16 Oct 2026
- Place
- United States
- Who
- CDE
- The way in
- Stolen or reused passwords
- Source
- California Attorney General
01 · What was reported
What was reported.
CDE reported a data breach to the California Attorney General. Its sample notice says: “The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to...
The way in, as the source states it: stolen or reused passwords.
02 · What we check for it
What we check for it.
Addresses at your domain in monitored breach databases.
03 · If this happens at your firm
If this happens at your firm.
- Give every work account a second sign-in step, and never use a work password anywhere else.What changes: a code or a tap on the phone at each new sign-in. It stays on. A backup code or a second device covers a lost phone, and the method is changed in the account's security settings.
- Never approve a sign-in you did not start. A prompt you did not start means your password is known.
- Change the password of any account that gets prompts nobody started, the same day.
04 · Source
Source.
Source: California Attorney General ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.