Devereux Foundation Data Breach: What Affected Individuals Need to Know

The Devereux Foundation appears on the California Attorney General’s public database of breach notices, which lists notices from organizations that notify more than 500 California residents. According to that listing, the breach dates are recorded as November 6 and November 9, 2025, and the notice was reported on July 23, 2026.

California law requires businesses and organizations to notify affected residents and, for larger breaches, to submit a sample notice to the Attorney General’s office. The presence of the Devereux Foundation on that official list confirms that a qualifying breach was reported. For the most authoritative account of the incident, the sample notice on file with the California Attorney General is the primary source.

At the time of writing, a detailed public notice describing the specific categories of information involved in the Devereux Foundation breach was not independently located. As a nonprofit that provides behavioral health and human services, the organization maintains sensitive information, but the specific data elements involved should be confirmed through the official notice.

If you received a notification letter from the Devereux Foundation, that letter is the definitive source for which categories of your information were involved and what protective services, if any, are being offered.

Because the breach appears on the California Attorney General’s list — capturing breaches affecting more than 500 California residents — the incident was significant enough to trigger mandatory notification. Organizations that provide behavioral health and human services often hold especially sensitive information, which makes protecting that data particularly important.

If you received a notice, treat it as a signal to take protective steps. Keeping the notice and following its instructions is the best way to understand and respond to your specific exposure.

Review your notification letter carefully and keep it for your records. Monitor your financial accounts and review your free credit reports at AnnualCreditReport.com for unfamiliar activity. If any monitoring services are offered in your notice, consider enrolling promptly, and if health information may be involved, review your insurer’s Explanations of Benefits for services you did not receive.

You may also consider placing a fraud alert or a credit freeze with the major credit bureaus. Beyond self-protective steps, a legal professional can help you understand whether you may be entitled to compensation.

If you also received a notice from MBE CPAs, see our overview of the MBE CPAs data breach lawsuit.