What happened
On June 27–28, 2022, confidential personal information became publicly accessible through DOJ’s Firearms Dashboard. DOJ’s November announcement put the number of identifiable concealed-carry permit applicants affected at roughly 192,000.
What information was involved
DOJ’s incident page says the exposed concealed-carry records included names, dates of birth and street addresses, among other fields. The relevant applications dated from approximately 2012–2021. Social Security numbers and financial information were not in the exposed dataset.
The department says the dashboard was shut down within 24 hours and letters were sent to identifiable people who may have been affected. The incident page distinguishes these records from other firearms datasets that did not independently identify individuals.
Was the firearms dashboard exposure a hack?
DOJ says the dashboard was meant to publish aggregate statistics and interactive charts, not confidential personal records. Its incident FAQ says investigators found no evidence of an outside attacker or a compromise of DOJ systems in connection with the exposure.
That distinction changes the oversight question. The relevant controls include what data employees upload, what a visitor can download and who checks a dashboard before release. A chart can display totals while its underlying file contains identifying fields.
DOJ’s November 2022 commitments included reviewing personal-data policies, training staff for their specific roles, assessing software risks and hiring a chief information security officer with department-wide responsibility. Those are concrete commitments against which later implementation records can be checked.
What the review found
Morrison Foerster led the independent investigation with assistance from FTI. DOJ’s published summary describes inadequate training and expertise, insufficient documentation and procedures, and inadequate oversight. It also says the disclosure was unintentional.
The report documents an administrative failure. It does not suggest Bonta released the information on purpose.
Bonta’s response and DOJ’s commitments
Bonta apologized and called the release unacceptable. DOJ committed to implementing the recommendations, including stronger training, project review, incident planning and security oversight.
Open questions
The records reviewed don’t show when each reform was completed or whether it was tested. Promising changes isn’t the same as showing they worked.
Implementation dates, revised policies, training records and later audits would show whether DOJ followed through.
Questions and answers
When did the exposure happen?
June 27–28, 2022. Some online timelines place it in June 2024, but the DOJ investigation covers the 2022 incident.
How many people were affected?
The investigation counted roughly 192,000 concealed-carry permit applicants. Counts of records, notification letters and people aren’t the same thing.
Did the investigation find a deliberate release?
No. The commissioned review found the disclosure unintentional while documenting substantial departmental failures.
What did DOJ say it would change?
DOJ announced stronger training, procedures and security oversight. Whether those changes worked hasn’t been independently tested.
Link to this answerHave the reforms been independently verified?
Not in the records reviewed here. That would take completion dates and results for each recommendation.
Link to this answerWas the 2022 California DOJ data exposure caused by an outside hacker?
DOJ’s incident FAQ says the investigation found no evidence of an external attacker or a compromise of DOJ systems in connection with the exposure. The dashboard was intended to show aggregate information, not confidential personal records.
Link to this answerSources for this page
- Firearms Dashboard investigation announcement
California DOJ · November 30, 2022
DOJ’s summary of the investigation and announced response.
- 2022 Firearms Dashboard Data Exposure
California DOJ · Incident: June 27–28, 2022
Information on affected data, notification and recommended changes.
- Report of Investigative Findings and Recommendations
Morrison Foerster; published by California DOJ · November 2022
The 61-page independent investigation report. PDF.