Children’s Council of San Francisco Data Breach Exposes Sensitive Information of 12,655 Individuals
On February 23, 2026, the Children’s Council of San Francisco, a nonprofit specializing in early childhood education and family support, detected a data breach affecting 12,655 individuals across the U.S., including one resident of Maine. The incident exposed personally identifiable information (PII), specifically names and Social Security numbers.
The breach stemmed from unauthorized network access, first identified on August 3, 2025, when the organization experienced a network disruption. Cybersecurity experts were brought in to investigate, confirming that an unknown actor had accessed and exfiltrated data without authorization. A third-party vendor later conducted a comprehensive review to assess the full scope of the exposed information.
Written notifications were sent to affected individuals on March 2, 2026, and the breach was disclosed to the Maine Attorney General.
In response, the Children’s Council of San Francisco is offering complimentary credit monitoring and identity theft protection services through Cyberscout (a TransUnion company). These services include proactive fraud assistance, a $1 million identity theft insurance policy, and 12 months of credit monitoring alerts. Affected individuals have 90 days from the notification date to enroll.
The exposure of Social Security numbers heightens the risk of identity theft, underscoring the need for impacted individuals to monitor financial accounts and credit reports for suspicious activity.
Source: https://www.claimdepot.com/data-breach/childrens-council-of-san-francisco-2026
Children's Council of San Francisco cybersecurity rating report: https://www.rankiteo.com/company/children's-council-of-san-francisco
"id": "CHI1772642563",
"linkid": "children's-council-of-san-francisco",
"type": "Breach",
"date": "8/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '12,655',
'industry': 'Early Childhood Education and Family '
'Support',
'location': 'San Francisco, USA',
'name': 'Children’s Council of San Francisco',
'type': 'Nonprofit'}],
'attack_vector': 'Unauthorized Network Access',
'customer_advisories': 'Complimentary credit monitoring and identity theft '
'protection services (Cyberscout) including proactive '
'fraud assistance, $1 million identity theft '
'insurance, and 12 months of credit monitoring alerts. '
'Enrollment period: 90 days from notification date.',
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': '12,655',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Social Security Numbers']},
'date_detected': '2026-02-23',
'date_publicly_disclosed': '2026-03-02',
'description': 'On February 23, 2026, the Children’s Council of San '
'Francisco, a nonprofit specializing in early childhood '
'education and family support, detected a data breach '
'affecting 12,655 individuals across the U.S., including one '
'resident of Maine. The incident exposed personally '
'identifiable information (PII), specifically names and Social '
'Security numbers. The breach stemmed from unauthorized '
'network access, first identified on August 3, 2025, when the '
'organization experienced a network disruption. Cybersecurity '
'experts were brought in to investigate, confirming that an '
'unknown actor had accessed and exfiltrated data without '
'authorization. A third-party vendor later conducted a '
'comprehensive review to assess the full scope of the exposed '
'information. Written notifications were sent to affected '
'individuals on March 2, 2026, and the breach was disclosed to '
'the Maine Attorney General.',
'impact': {'data_compromised': 'Personally Identifiable Information (PII), '
'Social Security Numbers',
'identity_theft_risk': 'High',
'operational_impact': 'Network Disruption'},
'investigation_status': 'Completed',
'post_incident_analysis': {'root_causes': 'Unauthorized Network Access'},
'recommendations': 'Affected individuals are advised to monitor financial '
'accounts and credit reports for suspicious activity. '
'Complimentary credit monitoring and identity theft '
'protection services are offered through Cyberscout (a '
'TransUnion company).',
'references': [{'source': 'Maine Attorney General Disclosure'}],
'regulatory_compliance': {'regulatory_notifications': ['Maine Attorney '
'General']},
'response': {'communication_strategy': 'Written Notifications to Affected '
'Individuals, Disclosure to Maine '
'Attorney General',
'third_party_assistance': 'Cybersecurity Experts, Third-Party '
'Vendor Review'},
'threat_actor': 'Unknown Actor',
'title': 'Children’s Council of San Francisco Data Breach Exposes Sensitive '
'Information of 12,655 Individuals',
'type': 'Data Breach'}