Cybersecurity Incident at Children’s Council of San Francisco Exposes PII of Over 12,000 Individuals On March 18, 2026, the Children’s Council of San Francisco (ChCo), a childcare and early education provider, disclosed a cybersecurity breach that compromised the personal data of more than 12,000 individuals. The incident involved unauthorized access to ChCo’s network, during which sensitive personally identifiable information (PII) may have been acquired. Affected data includes individuals’ names paired with Social Security numbers. The breach is currently under investigation by Lynch Carpenter, LLP, a national class action law firm, which is reviewing potential legal claims against ChCo on behalf of impacted individuals. ChCo, based in San Francisco, California, serves families and children in early education programs. No further details on the attack’s origin or timeline have been released. The incident highlights ongoing risks to organizations handling sensitive personal data, particularly in sectors like childcare and education.

Children’s Council of San Francisco Data Breach Exposes Sensitive Information of 12,655 Individuals On February 23, 2026, the Children’s Council of San Francisco, a nonprofit specializing in early childhood education and family support, detected a data breach affecting 12,655 individuals across the U.S., including one resident of Maine. The incident exposed personally identifiable information (PII), specifically names and Social Security numbers. The breach stemmed from unauthorized network access, first identified on August 3, 2025, when the organization experienced a network disruption. Cybersecurity experts were brought in to investigate, confirming that an unknown actor had accessed and exfiltrated data without authorization. A third-party vendor later conducted a comprehensive review to assess the full scope of the exposed information. Written notifications were sent to affected individuals on March 2, 2026, and the breach was disclosed to the Maine Attorney General. In response, the Children’s Council of San Francisco is offering complimentary credit monitoring and identity theft protection services through Cyberscout (a TransUnion company). These services include proactive fraud assistance, a $1 million identity theft insurance policy, and 12 months of credit monitoring alerts. Affected individuals have 90 days from the notification date to enroll. The exposure of Social Security numbers heightens the risk of identity theft, underscoring the need for impacted individuals to monitor financial accounts and credit reports for suspicious activity.