Family & Community Services, a nonprofit operating over 70 programs across Ohio, Pennsylvania, and Michigan, suffered a ransomware attack by the Qilin group in May 2025. The breach exposed sensitive personally identifiable information (PII), including names, addresses, dates of birth, Social Security numbers, driver’s license numbers, dependent data, health records, and financial details of thousands of individuals likely clients, employees, or volunteers. The attackers claimed responsibility on the dark web in July 2025, confirming data exfiltration. The incident poses severe risks of identity theft, financial fraud, and unauthorized access to protected health information (PHI), with potential long-term reputational and operational damage. Affected individuals are being notified via mail, and legal investigations for compensation are underway. The breach underscores critical vulnerabilities in the organization’s cybersecurity, particularly given its merger with AxessPointe Community Health Centers in early 2024.
Source: https://www.claimdepot.com/investigations/family-community-services-data-breach-2025
TPRM report: https://www.rankiteo.com/company/family-&-community-services-inc-
"id": "fam2862428091825",
"linkid": "family-&-community-services-inc-",
"type": "Ransomware",
"date": "6/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Thousands (exact number '
'unreleased)',
'industry': 'Social Services / Healthcare',
'location': 'Portage County, Ohio (operates in Ohio, '
'Pennsylvania, Michigan)',
'name': 'Family & Community Services Inc.',
'size': 'Large (serves 100,000+ annually, 3,500+ '
'volunteers)',
'type': 'Nonprofit Organization'},
{'industry': 'Healthcare',
'location': 'Northeast Ohio',
'name': 'AxessPointe Community Health Centers '
'(post-merger: Axess Family Services)',
'type': 'Healthcare Provider'}],
'attack_vector': 'Ransomware (Qilin)',
'customer_advisories': ['Vigilance against identity theft',
'Credit monitoring enrollment',
'Fraud alert placement',
'Legal rights for compensation'],
'data_breach': {'data_encryption': 'Likely (ransomware attack)',
'data_exfiltration': 'Yes (claimed by Qilin ransomware group)',
'number_of_records_exposed': 'Thousands (exact number '
'unreleased)',
'personally_identifiable_information': ['Name',
'Address',
'Date of birth',
'Social Security '
'number',
"Driver's license "
'number',
'Dependent '
'information'],
'sensitivity_of_data': 'High (includes SSN, health data, '
'financial info)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Protected Health Information '
'(PHI)',
'Financial Information']},
'date_detected': '2025-05-22',
'date_publicly_disclosed': '2025-07-02',
'description': 'Family & Community Services Inc., a nonprofit organization '
'based in Portage County, Ohio, discovered a potential '
'compromise of its systems by an unauthorized actor on May 22, '
'2025. The Qilin ransomware group claimed responsibility for '
'the attack, posting about the incident on the dark web on '
'July 2, 2025. The breach is believed to involve ransomware, '
'with compromised data potentially including sensitive '
'personal and protected health information of thousands of '
'individuals.',
'impact': {'brand_reputation_impact': 'Potential reputational harm due to '
'exposure of sensitive data',
'data_compromised': ['Name',
'Address',
'Date of birth',
'Social Security number',
"Driver's license number",
'Dependent information',
'Health information',
'Financial information'],
'identity_theft_risk': 'High (due to exposure of PII and PHI)',
'legal_liabilities': 'Potential lawsuits and compensation claims',
'payment_information_risk': 'Potential (financial information '
'exposed)'},
'initial_access_broker': {'data_sold_on_dark_web': 'Claimed by Qilin group '
'(posted on dark web)'},
'investigation_status': 'Ongoing (as of July 2025)',
'motivation': 'Financial (likely ransom demand)',
'ransomware': {'data_encryption': 'Likely',
'data_exfiltration': 'Yes',
'ransomware_strain': 'Qilin'},
'recommendations': ['Monitor financial statements for suspicious activity',
'Enroll in credit monitoring/identity protection services '
'if offered',
'Place fraud alerts with credit bureaus',
'Review annual credit reports',
'Seek legal counsel for compensation claims'],
'references': [{'source': 'Shamis & Gentile P.A. Investigation Notice'},
{'source': 'Family & Community Services Notice of Data '
'Security Incident'}],
'regulatory_compliance': {'legal_actions': 'Potential lawsuits (investigation '
'by Shamis & Gentile P.A.)'},
'response': {'communication_strategy': 'Public notification (website notice) '
'and mail notifications to impacted '
'individuals post-review',
'incident_response_plan_activated': 'Yes (investigation '
'ongoing)'},
'stakeholder_advisories': 'Public notice on website; mail notifications '
'planned post-review',
'threat_actor': 'Qilin Ransomware Group',
'title': 'Family & Community Services Data Breach (2025)',
'type': 'Data Breach / Ransomware Attack'}