What happened
On June 27–28, 2022, confidential personal information became publicly accessible through DOJ’s Firearms Dashboard. DOJ’s November announcement put the number of identifiable concealed-carry permit applicants affected at roughly 192,000.
How the dashboard launched
DOJ’s Bureau of Firearms asked the department’s Research Center in late 2021 to build an updated firearms dashboard, citing public interest and a high volume of public records requests, according to the independent report. The dashboard received final approval for publication on June 16, 2022.
The U.S. Supreme Court decided New York State Rifle & Pistol Association v. Bruen on June 23, 2022. The next day, Bonta advised sheriffs and police chiefs that they could no longer require applicants to show “good cause” for a concealed-carry permit. The dashboard went live the following Monday, June 27, with a press release in which Bonta said “transparency is key to increasing public trust.” The report concluded the publication date was not driven by the Bruen decision.
The first 24 hours
The report reconstructs what happened. The dashboard was published around 12:30 p.m. on June 27. At about 6:15 p.m., screenshots showing personal data were sent by direct message to the Attorney General’s personal Twitter account. That evening, the Research Center director learned that confidential concealed-carry data sat in the underlying dataset but accepted assurances that it was not publicly accessible.
At about 9:30 p.m., at the direction of the chief of DOJ’s Criminal Justice Information Services division, the dashboard was put back online with the original data. The report called that a compounding error. DOJ replaced the concealed-carry file early on June 28, confirmed the exposure that morning, took the dashboard down at 11:45 a.m. and pulled its entire OpenJustice data portal offline that night.
During the exposure, the dataset was downloaded in full or in part about 2,734 times from 507 unique IP addresses, according to the report. The Fresno County Sheriff’s Office was among the first to alert the public, after hearing from the California State Sheriffs’ Association.
What information was involved
DOJ’s incident page says the exposed concealed-carry records included names, dates of birth and street addresses, among other fields. The relevant applications dated from approximately 2012–2021. Social Security numbers and financial information were not in the exposed dataset.
The department says the dashboard was shut down within 24 hours and letters were sent to identifiable people who may have been affected. The incident page distinguishes these records from other firearms datasets that did not independently identify individuals.
Was the firearms dashboard exposure a hack?
DOJ says the dashboard was meant to publish aggregate statistics and interactive charts, not confidential personal records. Its incident FAQ says investigators found no evidence of an outside attacker or a compromise of DOJ systems in connection with the exposure.
That distinction changes the oversight question. The relevant controls include what data employees upload, what a visitor can download and who checks a dashboard before release. A chart can display totals while its underlying file contains identifying fields.
DOJ’s November 2022 commitments included reviewing personal-data policies, training staff for their specific roles, assessing software risks and hiring a chief information security officer with department-wide responsibility. Those are concrete commitments against which later implementation records can be checked.
What the review found
Morrison Foerster led the independent investigation with assistance from FTI. DOJ’s published summary describes inadequate training and expertise, insufficient documentation and procedures, and inadequate oversight. It also says the disclosure was unintentional.
The report documents an administrative failure. It does not suggest Bonta released the information on purpose.
Where the report placed responsibility
The report does not name individual employees. It found that the data analyst who built the dashboard was “inattentive to established policies and procedures” and did not understand the software’s security settings, and that supervisors “relied on presumptions” instead of checking. It faulted the CJIS chief for relying on unverified assurances, restoring the dashboard and not telling the chief deputy attorney general that confidential data was in the file. It found no nefarious intent.
DOJ declined to discuss discipline, saying it would “take appropriate corrective action.” No public report of anyone being disciplined has been found. In July 2022, Bonta said the department would be “holding folks accountable, appropriately.”
Bonta’s response and DOJ’s commitments
Bonta apologized and called the release unacceptable. DOJ committed to implementing the recommendations, including stronger training, project review, incident planning and security oversight.
What affected applicants were offered
DOJ mailed notification letters to about 218,000 potentially affected people around July 8, 2022, more than the roughly 192,000 it could independently identify. It offered 12 months of free triple-bureau credit monitoring, dark-web monitoring, a $1 million identity-theft insurance policy and recovery services.
Exposed permit holders included current and retired judges, prosecutors and retired law enforcement officers, the San Diego Union-Tribune reported. The outage also reached beyond firearms data: with OpenJustice offline, crime statistics, police use-of-force records and deaths-in-custody data used by researchers and journalists were unavailable for weeks.
Lawsuits and claims
On July 1, 2022, the National Association for Gun Rights and a Sacramento firearms instructor filed a federal class action against Bonta in his official capacity, alleging constitutional and state privacy violations. Later that month, permit holders represented by attorneys Brian Hannemann and Marc Mabile filed a second suit. The outcomes of both cases have not been confirmed in the public reporting reviewed for this page.
Individual claims followed. The California Rifle & Pistol Association reported that one member won a $5,000 small-claims judgment against DOJ under the state Information Practices Act, and said DOJ reported nearly 500 government claims filed over the leak.
Criticism and calls for an audit
Butte County Sheriff Kory Honea, then president of the State Sheriffs’ Association, said “it is infuriating that people who have been complying with the law have been put at risk.” Assembly Republican leader James Gallagher demanded the error be corrected, and security experts told the Associated Press that the response should have taken far less than 24 hours.
Assemblymember Jim Patterson (R-Fresno) asked for an emergency State Auditor review. After DOJ released its commissioned report, he said “saying you’re sorry and it won’t happen again isn’t good enough.” No State Auditor review of the incident has been found.
Open questions
The records reviewed don’t show when each reform was completed or whether it was tested. Promising changes isn’t the same as showing they worked.
Implementation dates, revised policies, training records and later audits would show whether DOJ followed through.
Questions and answers
When did the exposure happen?
June 27–28, 2022. Some online timelines place it in June 2024, but the DOJ investigation covers the 2022 incident.
How many people were affected?
The investigation counted roughly 192,000 concealed-carry permit applicants. Counts of records, notification letters and people aren’t the same thing.
Did the investigation find a deliberate release?
No. The commissioned review found the disclosure unintentional while documenting substantial departmental failures.
What did DOJ say it would change?
DOJ announced stronger training, procedures and security oversight. Whether those changes worked hasn’t been independently tested.
Link to this answerHave the reforms been independently verified?
Not in the records reviewed here. That would take completion dates and results for each recommendation.
Link to this answerWas the 2022 California DOJ data exposure caused by an outside hacker?
DOJ’s incident FAQ says the investigation found no evidence of an external attacker or a compromise of DOJ systems in connection with the exposure. The dashboard was intended to show aggregate information, not confidential personal records.
Link to this answerSources for this page
- Firearms Dashboard investigation announcement
California DOJ · November 30, 2022
DOJ’s summary of the investigation and announced response.
- 2022 Firearms Dashboard Data Exposure
California DOJ · Incident: June 27–28, 2022
Information on affected data, notification and recommended changes.
- Report of Investigative Findings and Recommendations
Morrison Foerster; published by California DOJ · November 2022
The 61-page independent investigation report. PDF.
- California concealed carry after Bruen
CalMatters · June 29, 2022
Bruen timing and DOJ guidance to sheriffs and police chiefs.
- Attorney General Bonta releases new firearms data
California DOJ · June 27, 2022
The dashboard launch announcement.
- California DOJ exposed data for 190K concealed weapons applicants
Sacramento Bee via GovTech · December 2, 2022
Coverage of the report’s findings and reactions.
- California DOJ apologizes for ‘unacceptable’ breach
The Record · June 30, 2022
How the exposure became public.
- Data leak exposes judges, prosecutors
San Diego Union-Tribune via GovTech · July 5, 2022
Who was affected.
- California DOJ data portal remains down after breach
GovTech · July 15, 2022
The OpenJustice outage.
- Complaint, National Association for Gun Rights v. Bonta
C.D. Cal. No. 2:22-cv-04543 · July 1, 2022
A complaint states allegations, not findings. PDF.
- Lawsuit filed over massive California DOJ data leak
GovTech · July 19, 2022
The Hannemann and Mabile suit.
- Member wins $5,000 in CCW data breach case
California Rifle & Pistol Association · September 6, 2023
Advocacy organization’s account.
- California lacked safeguards for gun owner info, experts say
Associated Press via NBC San Diego · July 2, 2022
Expert and legislative criticism.
- Patterson seeks emergency audit
SJV Sun · July 19, 2022
Request for a State Auditor review.
- WhatMatters: concealed carry data breach
CalMatters · July 20, 2022
Bonta on accountability.