CR&R Incorporated, the Southern California waste and recycling company, sent breach notification letters referencing two incident dates — October 19, 2022 and December 18, 2022 — though the notice was not filed with the California Attorney General until January 23, 2025, more than two years later. The excerpt of the letter available to us does not explain the cause of the incident, so the attack method has not been confirmed, and we won’t speculate beyond what the company has stated.
