Improper Disposal
1 confirmed incidents.
VERIS: error:Disposal error
Improper disposal is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used on the HHS Office for Civil Rights breach portal and similar state breach-notification forms when personal data was exposed by disposing of records, paper files, hard drives or backup tapes, without properly destroying or sanitizing them first. This is one of the few attack types on the site that describes a data-handling failure rather than an active intrusion; exposure occurs when the discarded material is found, rather than through remote access.
Top organizations
| Organization | Confirmed incidents |
|---|---|
| Regional Center of Orange County | 1 |
Recent incidents
| Organization | Disclosed | Jurisdiction | Records affected |
|---|---|---|---|
| Regional Center of Orange County | July 27, 2026 | US-CA | 16,545 |
Questions and answers
How many confirmed incidents are classified as Improper Disposal on Breach Census?
1 confirmed incidents are currently classified as Improper Disposal.
Which organization has the most confirmed Improper Disposal incidents?
Regional Center of Orange County, with 1 confirmed incidents classified this way.
Why doesn't the Improper Disposal classification map to a MITRE ATT&CK technique?
Improper Disposal is a regulator reporting category rather than an attacker technique -- it is used when a source document classifies an incident this way without specifying a technical method, so it has no MITRE ATT&CK id of its own.
What counts as a confirmed incident for the Improper Disposal classification?
An incident counts here once it carries the Improper Disposal attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.