State Bar begins notifying individuals ID'd in data breach

Executive Director Leah Wilson says contacting those affected is the `right thing to do'

The State Bar of California has begun notifying thousands of individuals whose names appeared in 322,525 confidential attorney discipline records published online in a massive data breach discovered in February, Specifically, the State Bar said Friday it will contact through email or postal mail 1,300 complainants, witnesses or respondents whose names appeared in the 1,034 confidential records that showed evidence of a page view. Those named in unviewed records with emails on file with the State Bar also will be contacted. “We are taking these steps because we believe it's the right thing to do,” State Bar Executive Director Leah Wilson said in a statement. “The State Bar is committed to transparency, and maintaining the public's trust in our agency is paramount. That said, we had to balance our commitment to being transparent with considerations of costs, logistics, and fiscal prudence. We believe we have struck the right balance.”

The documents, published by public records aggregator Judyrecords, remained online from Oct. 15, 2021, to Feb 26, 2022.

The breach, first reported by the Southern California News Group, was not a malicious hack, but rather a security vulnerability in the State Bar's case management system operated by Texas-based Tyler Technologies. As a result, the confidential records were unintentionally swept up and published by Judyrecords.

Access to the State Bar Court's public records has been restored and the case management portal vulnerability has been corrected.

The search function on the Judyrecords website remained disabled Friday. The website's administrator said in a note to users the Tyler Technologies portal glitch allowed access to court cases for various jurisdictions in California, Texas, Georgia and Kansas.