A Social Security number, a date of birth, and a full name — that triad is the starter kit for new-account fraud, tax-refund theft, and knowledge-based authentication bypass. Kings United Way told California residents those three fields were among the data it inadvertently posted to a data-sharing platform, then discovered the mistake on August 26, 2026 and pulled the file down. This was not a ransomware crew dumping a leak site. It was a verified mis-share: sensitive client identity data landed where it should not have, and the nonprofit had to notify people under California’s breach rules.
The California Attorney General published a sample notification letter from Kings United Way (KUW). The letter is dated September 25, 2026. It apologizes, describes the August 26 discovery, lists name, date of birth, and Social Security number as the involved fields, and says recipients are automatically covered for IDX identity-restoration assistance — no enrollment step required. The sample does not publish a headcount. Do not invent one; treat “was I affected” as a mail-and-letter question until KUW or a regulator states a census.
BreachHistory’s canonical record is at https://breachhistory.com/kings-united-way/kings-united-way2026. If you used Kings United Way programs or a partner organization’s services and you receive this notice, assume your SSN is compromised for fraud purposes even though the root cause was operational error rather than a named cyberattack.
What happened: inadvertent posting, not a hack narrative
According to the notice, Kings United Way discovered on August 26, 2026 that sensitive information had been inadvertently posted to a data-sharing platform. As soon as staff became aware, they removed the data and took steps to secure it. The letter’s phrasing matters. “Inadvertently posted” points to a human or process failure in how files were shared — wrong audience, wrong permission set, wrong upload destination — not to an extortion group claiming network access.
Data-sharing platforms are routine in nonprofit and social-services work. Partners exchange eligibility lists, referral rosters, and client identifiers so people can get housing help, food assistance, workforce programs, or coordinated case management. Those workflows create pressure to move spreadsheets and exports quickly. When a file that includes Social Security numbers lands on a platform with broader access than intended, the exposure is real even if nobody “broke in.” Anyone who could view that share during the window had the raw material for identity theft.
What this is not: a public claim that ransomware encrypted Kings United Way systems, that a dark-web marketplace is selling a KUW dump, or that an outsider exploited a zero-day. Stick to the attested facts. The risk to individuals still tracks the worst consumer breaches because the field set is SSN-grade.
Timeline of the Kings United Way notice
- On or before August 26, 2026: Sensitive information is inadvertently posted to a data-sharing platform (exact upload date not stated in the sample letter).
- August 26, 2026: Kings United Way discovers the posting; removes the data from the platform; begins securing the material and reviewing what fields were involved.
- After discovery: KUW implements additional safeguards for data sharing and retrains staff on protecting personal information.
- September 25, 2026: Sample notification letter date on the California AG filing; recipients are told about IDX automatic restoration coverage and FTC-style credit protections.
- Late September 2026: The notice appears in California’s public breach sample library, making the incident searchable for residents and journalists.
Roughly a month separates discovery and the dated sample letter — common while orgs inventory victims and clear language. For people in the file, the practical clock started when the data sat on the platform. The sample does not say how long the file was visible or who could access it; absence of a published window is not proof the exposure was fleeting.
What data was exposed
KUW’s review of the posted material determined it included:
- Name
- Date of birth
- Social Security number
That inventory is short and severe. Name plus date of birth plus SSN is enough for many lenders’ and call centers’ outdated identity checks. Fraudsters use the same trio to file false tax returns, open credit cards, apply for government benefits in someone else’s name, or pass “please verify your Social” scripts when they already know the answer.
United Way affiliates often hold data because someone sought help — or because a partner referred them. The letter states KUW may have your information if you utilized the organization’s services or those of a partner organization. That expands the risk pool beyond people who think of themselves as “Kings United Way clients” in a narrow sense. A partner-agency referral list can carry the same three fields.
What was not claimed
The sample notice does not list driver’s license numbers, medical records as a class, bank account numbers, payment cards, passwords, or email credentials. Do not assume those were in the mis-shared file. Conversely, do not treat the short list as harmless. An SSN alone, when glued to a real name and DOB, outranks a loyalty-email dump for long-term fraud value.
The letter also does not publish how many people were affected. California sample letters sometimes omit census figures that appear only in the confidential regulator submission or in later press. Until a reliable count surfaces, catalog systems that require a number should keep recordsAffected at zero rather than guess. Readers searching “Kings United Way data breach” for a million-person headline will not find one in this primary source — and inventing scale would be dishonest.
KUW does not claim, in the sample, that it has evidence of misuse against every recipient. Many notices stay silent on misuse or say they are unaware of it. Silence is a forensic status at mailing time, not a warranty that no one copied the share.
Who is at risk
People who receive the Kings United Way letter
Primary risk is anyone named in the notification. Keep the letter. It is your proof for credit freezes, tax disputes, and conversations with IDX. If the envelope names you and lists name, DOB, and SSN, treat those fields as burned for knowledge-based authentication.
Clients and partner-organization beneficiaries without a letter yet
Mail can lag. If you used Kings United Way services or a partner program in Kings County / Central Valley California social-services networks and you later get the notice, you were in the population for notice purposes. If you never receive one, do not assume exposure — but do not dismiss a letter because you last interacted with a partner agency rather than KUW’s front desk.
Household members
Even when only one adult’s SSN was in the file, household phishing rises. Callers who already know a relative “got a Kings United Way breach letter” will ask a spouse to “confirm the last four to finish IDX coverage.” Brief the household so that script dies on contact.
People with thin credit files
Nonprofit client populations often include people rebuilding credit or under financial stress. Disputing SSN fraud is harder with fewer established accounts and less spare time for bureau holds.
Why an inadvertent data-sharing post still matters
Security coverage skews toward ransomware splash pages. Mis-shares are quieter and, for the person whose SSN was in the spreadsheet, often identical in outcome. A file on a collaboration platform may have been visible to the wrong partner staff, a contractor with broad tenant access, or anyone who received a share link. The notice does not inventory those viewers. What it does confirm is that KUW judged the event serious enough for California AG notification and identity-restoration coverage.
Nonprofits sit in a hard place. Funders and partners demand measurable outcomes; measuring outcomes often means shipping identifiable client lists. Without strict data-minimization — drop SSNs from working shares, use tokens, encrypt exports, expire links — a routine upload becomes a breach letter. Retraining and “additional safeguards when sharing data,” which KUW says it implemented, are the correct operational response. They do not rewind who already saw the file.
The Kings United Way breach fits that boring, high-stakes category: collaboration-path SSN notices that ransomware coverage misses, but credit freezes still require.
What Kings United Way and California regulators said
The primary source is the September 25, 2026 sample letter filed with the California Attorney General. KUW identifies itself as a non-profit supporting local residents and communities through a variety of programs. It describes the August 26, 2026 discovery of inadvertent posting to a data-sharing platform, immediate removal, additional sharing safeguards, and retraining on protecting personal information.
On remedies, the letter is unusually clear about enrollment friction: recipients are automatically covered with IDX fully managed identity resolution / ID theft recovery services. There is no need to enroll for that benefit. If identity theft issues arise, the letter directs people to call IDX at 1-833-788-9712. It also points to IDX’s account-creation / protect URL for assistance and notes Certified Recovery Advocates’ weekday Pacific Time hours. Automatic coverage is helpful — and it is also a phishing magnet, because scammers will pretend you must “activate” coverage by retyping your SSN.
The letter urges vigilance for 24 months: review financial statements and credit reports; consider fraud alerts and security freezes; use FTC identity-theft guidance; California residents can visit the AG’s privacy resources. Those recommendations are standard, but they are the right ones when SSNs are in play.
California’s public sample library is how many residents learn a local nonprofit had a problem. The AG posting does not independently audit KUW’s forensics; it publishes the notice the organization submitted. For verification purposes under BreachHistory rules, a California AG sample letter naming the company, the discovery date, the fields, and the remediation is a regulator-attested notice — sufficient to catalog the incident as verified, with companyConfirmed true via the organization’s own letter.
Industry context: nonprofit PII and California notice culture
California’s breach-notification regime forces organizations that hold California residents’ personal information to speak up when certain data elements — notably SSNs — are acquired by an unauthorized person or reasonably believed to have been. An inadvertent post to a data-sharing platform can meet that bar when the audience was not authorized for that content. That is why a mid-sized community nonprofit can appear in the same AG feed as national retailers.
United Way–network programs create datasets that look administrative to staff and look like gold to fraud rings. Sector guidance has long pushed data minimization for SSNs — collect only when required, segregate SSN columns, never park full SSNs on general collaboration shares. Prefer the PDF sample letter over secondary sites that invent a victim count the letter never stated.
What you should do
If you received the Kings United Way notice — or you are deciding how to respond after reading the CA AG sample — work this list.
- Keep the letter and note the date. Scan it to personal encrypted storage. You will need it if a creditor disputes your freeze request or if tax authorities ask why you filed an identity-theft affidavit.
- Use IDX restoration help without feeding phishers. The letter says you are already covered for fully managed identity resolution. Call the number printed on your letter (sample: 1-833-788-9712) if you have an active identity-theft issue. Do not “re-verify” your full SSN through an unsolicited text that claims coverage will lapse.
- Place credit freezes at Equifax, Experian, and TransUnion. Freezes are free and block most new-account fraud. Monitoring watches after the fact; a freeze stops the account from opening. Lift temporarily with a PIN when you apply for credit yourself.
- Consider a fraud alert as a complement, not a substitute. An initial fraud alert lasts one year and tells creditors to take extra steps. Contacting one bureau typically propagates to the others. Still freeze if you can live with the friction.
- Pull your free annual credit reports on a staggered schedule. Use annualcreditreport.com. Spreading Equifax, Experian, and TransUnion requests a few months apart gives you more frequent eyes on the file over a year.
- Watch tax and benefits fraud. Enable an IRS online account with strong MFA where available; consider an IP PIN. State tax and benefits portals that still lean on SSN + DOB are soft targets after a name/DOB/SSN exposure.
- Assume knowledge-based authentication is weak for you now. Ask banks and utilities what else they will accept. Turn on login and transaction alerts. Prefer app-based MFA over SMS when the institution allows it.
- Lock down email and phone-number ports. Attackers who have your real name and DOB will try SIM-swap and inbox takeover to intercept one-time codes and bank resets. Set a carrier PIN; rotate the password on the mailbox that receives nonprofit and bank mail.
- Brief household members and partner-caseworkers you trust. Tell them scammers may name Kings United Way or IDX. Real staff will not demand your SSN over a cold call to “finish” automatic coverage.
- Plan past the first year. The letter’s 24-month vigilance window is closer to reality than a one-week panic. Keep freezes on. Identity misuse from a 2026 SSN exposure can appear in 2027 or 2028.
Phishing and follow-on fraud to expect
Real breach letters create perfect cover stories for fake ones. Expect:
- Emails or texts: “Your Kings United Way IDX coverage is not active — enter SSN to enroll” (contradicts the letter’s automatic-coverage language).
- Lookalike domains mimicking unitedway, kingscounty, or idx recovery portals registered last week.
- Calls that already know your name and the August 2026 discovery date and ask for “the rest of your Social to confirm you are the client.”
- Fake partner-organization forms claiming a “re-intake” after the data-sharing incident and harvesting more PII.
Hang up on unsolicited callers. Use contact channels printed on the paper notice. Confirm URLs against the letter, not against a link in SMS. Kings United Way will not need you to upload a selfie video of your Social Security card to a random Drive folder to “complete the CA AG process.”
Was I affected?
There is no public roster. The honest answer is: check your mail for a Kings United Way notice describing an August 26, 2026 data-sharing platform incident and listing name, date of birth, and Social Security number. Presence on social media rumor threads does not put you in the population. Absence of a letter so far does not prove you were outside the file if notices are still rolling, but you should not self-declare exposure without the notice or a direct confirmation from KUW.
Have I Been Pwned will not reliably answer this — it is a regulator notice after an inadvertent post, not a consumer paste-site dump. Rely on the letter. If you never used KUW or its partners, you are unlikely to be in scope.
Canonical record and sources
Full BreachHistory catalog entry: Kings United Way — name, DOB, SSN posted to data-sharing platform (2026).
Primary source:
Related reading on collaboration-path identity risk: DMDC file-share military PII exposure (different sector, same lesson: shared platforms plus SSN-grade fields create durable fraud risk).
The Kings United Way data breach is a reminder that Social Security numbers do not care whether the root cause was ransomware or a mis-aimed upload. On August 26, 2026, a California nonprofit found that triad — name, date of birth, SSN — on a data-sharing platform where it should not have been, removed it, retrained staff, hardened sharing safeguards, and mailed notices with automatic IDX restoration help. If that letter has your name on it, freeze credit, treat SSN-based verification as hostile territory, and ignore anyone who asks you to type the same Social Security number back into a stranger’s form to “finish” protection you were already told you have.