Central Valley IT Security Incidents
A sourced record of publicly documented security incidents affecting Central Valley organizations — and what each one suggests about how business environments are actually structured.
Last reviewed: September 11, 2026. Every incident below is attributed to a named outlet, tracker or official filing, and linked where that reporting is still publicly accessible. Incidents we cannot source that way are not listed here, whatever we see being searched for.
Central Valley organizations have experienced ransomware, vendor-related data exposure, and delayed breach discovery — across public, education and private-sector environments alike.
This is a running reference of publicly documented IT security incidents affecting Central Valley organizations. It exists because local business owners keep asking a version of the same question after each one: does that have anything to do with us?
It is not news coverage — the outlets linked below did that reporting, and they did it better than we would. What this page adds is the operational read: what each incident suggests about how business environments are structured, and which question it is worth asking about your own.
Most Recent First
Documented Incidents
- Disclosed July 2026 · Breach occurred August 2025
Fresno County Department of Social Services
A data file containing In-Home Supportive Services client information was accessed without authorization. The county reported that names and case numbers for 1,114 clients were involved, along with 636 phone numbers and a small number of addresses. The county notified affected individuals by mail and reported the incident to the California Attorney General.
Reported by The Business Journal and CBS47 / KSEE24.
The operational read: the unauthorized access occurred in August 2025 and was not identified until June 2026. The gap between an event and its discovery is usually the most expensive part of an incident, and it is the part most environments have the least visibility into.
- May 2026
Fresno State and State Center Community College District — via Instructure / Canvas
Instructure, the company behind the Canvas learning management system, was breached. Canvas is used by Fresno State, Fresno City College, Clovis Community College and thousands of other institutions. Personal data associated with Canvas accounts was potentially exposed. Passwords, government IDs and financial information were not reported as compromised.
Covered locally by ABC30, CBS47/KSEE24, KMPH and The Business Journal. Background: 2026 Canvas data breach.
The operational read: neither institution was breached directly. A vendor they relied on was, and the exposure followed. Most organizations can name their critical vendors. Far fewer can say what data each one can actually reach.
- January 2025
Drive Line Service of Fresno
The RansomHub ransomware group targeted Drive Line Service of Fresno, a driveline and drive shaft repair business operating since 1985. A direct ransomware attack on a private local business — the category that rarely reaches regional news but happens consistently.
Documented by Halcyon.ai ransomware tracking.
The operational read: ransomware groups are not selecting targets by prominence. A long-established local business with a modest IT footprint is a normal target, not an unlikely one.
- Previously reported
Visalia Unified School District
VUSD experienced a ransomware attack that took district computer systems offline.
Covered by ABC30 Fresno.
The operational read: a public institution with dedicated IT staff and a defined budget. Neither of those is the variable that determines whether an environment recovers quickly.
We see a steady volume of searches for municipal breaches in several Central Valley cities that we have not been able to verify against any primary source. Those are not listed here. Naming an organization as a breach victim is not something to do on the strength of a search trend, and a reference page is only worth having if the absence of an entry means something.
The Pattern Underneath These
The common pattern is not industry or organization size. It is incomplete visibility into vendors, access, and detection.
These four incidents look unrelated. A county department, two colleges via a shared vendor, a repair business, a school district. Different sectors, different sizes, different budgets.
What they share is structural rather than technical. In each case the exposure grew through something ordinary — a vendor relationship whose data scope was never mapped, access that persisted after it stopped being needed, or a gap between when something happened and when anyone noticed. None of that is a criticism of the organizations involved. It describes how most environments are built: things get added as the organization grows, vendors accumulate, permissions drift, and no one is looking at the whole picture at once.
If you want the longer version of that argument, with the three questions worth asking about your own environment, it is in what local businesses should take from these incidents. For the difference between owning security tools and having a security structure, see security tools vs security structure. If something already feels wrong right now, start with how to respond to a ransomware scare.
Want to know where your own environment actually stands?
A structured assessment produces a documented picture of vendor access, backup integrity and access controls — what is mapped, what is unclear, and what deserves attention first. Independent of anyone selling you a product.
See what an assessment covers Take the free ScorecardCommon Questions
How often is this page updated?
It is reviewed when a Central Valley incident is publicly reported, and the review date at the top is updated each time — whether or not anything was added. A reference page that does not say when it was last checked is not much of a reference.
Why isn’t the incident I searched for listed here?
Most likely because we could not verify it against a recognized outlet or an official filing. Search interest in an incident is not evidence that it happened, and this page only lists what can be sourced. If you have a link to reporting we have missed, send it to us and we will review it.
My business wasn’t affected by any of these. Why does it matter?
The useful question is not whether you were named. It is whether your environment has the same structural gaps — unmapped vendor data access, permissions that were never reviewed, or no reliable way to notice that something has happened. Those gaps are common, and they are visible in a structured review well before an incident makes them obvious.
Does Divine Logic provide incident response?
We work with Central Valley businesses on the structural side — documenting environments, mapping vendor access, verifying that backups actually restore, and establishing who owns what. If you are in an active incident right now, that is a different and more urgent conversation: call (559) 432-7770.