Picture getting a call about a data breach at your business, and the first thing you do is pull up your client list to figure out who's affected. You go through it name by name, cross-referencing against what got exposed, trying to figure out who you need to call.
What Happened
Except none of the names match. Not because nothing was exposed, something clearly was, Social Security numbers, medical records, personal information. But none of the people whose information got out are on your client list. They never signed an engagement letter with you. They never gave you their information directly. Most of them have no idea your business has ever heard of them, let alone that their SSN was sitting on your network.
Then it clicks. The information came in through a case. A claim. A dispute where these people were the opposing side, not your side. You've had their data all along, not because they chose to work with you, but because the nature of the work put it there.
That's not a hypothetical scramble. It's close to what happened at an Encino-based employment and workers' compensation defense firm in spring 2026. Someone gained unauthorized access to its network and potentially viewed files containing names, Social Security numbers, and medical and treatment information tied to workers' compensation claims. The firm represents employers and insurance carriers in these cases, which means the people whose data was exposed were largely injured workers on the opposing side, not the firm's own clients at all.
Why This Is Easy to Miss Until It's Not
Most businesses think about data protection in terms of "our customers" or "our clients," the people who signed up, opted in, gave consent for you to hold their information. That mental model quietly leaves out a whole category: the data that arrives because of a process, not a relationship. Litigation. Insurance claims. Debt collection. Background checks. HR investigations. In every one of those, sensitive information about someone shows up on your systems, and that someone never chose you.
It's not negligence to end up holding that kind of data. It's often just what the work requires. The mistake, if there is one, is treating it as lower priority because the person it belongs to isn't who you're accountable to day to day. A Social Security number doesn't become less valuable to steal because the person it belongs to never signed anything with you.
A Social Security number doesn't become less valuable to steal because the person it belongs to never signed anything with you.
IT Accuracy Editorial Analysis
Do you know every category of person whose data your business is holding?
Get a Free Data Exposure ReviewWhat To Actually Do
If your business touches insurance claims or defense work, debt collection or account recovery, HR investigations or workplace disputes, or background checks or vendor due diligence, you're likely holding this exact category of data right now, whether or not you've thought of it that way.
Action steps for Los Angeles businesses
Picture the same breach call again, but this time you already have a map of every category of person whose data touches your systems, not just your client list. You know this third-party category exists, you've already secured it the same way you secured everything else, and when the call comes, you're not discovering a blind spot in real time, you're confirming a plan you already had. That's the actual gap this closes. Not whether a breach can happen, it can happen to anyone. Whether you find out you were protecting people you didn't even think of as needing protection, or whether you find out the hard way that you weren't.
Data Security topic cluster: related reading
TAGS
Managed IT Services | Los Angeles, CA
IT Accuracy provides cybersecurity and security awareness training, managed network services, cloud solutions, and help desk support for businesses across Los Angeles and nationwide.
