Philadelphia Corporation for Aging (PCA) experienced a cybersecurity breach where an unauthorized individual accessed its network and potentially acquired records containing personally identifiable information (PII) of an unknown number of individuals. The incident prompted a legal investigation by Lynch Carpenter, LLP, a national class action law firm, which is assessing claims for potential compensation for affected parties. The breach exposed sensitive personal data, raising concerns about identity theft, fraud, and privacy violations. PCA has not disclosed the exact scope of the compromised data, but the involvement of a law firm suggests significant legal and reputational risks. The incident underscores vulnerabilities in PCA’s cybersecurity defenses, particularly in safeguarding PII from external threats. Affected individuals are being urged to seek legal counsel to evaluate their eligibility for compensation.

Between July 10 and July 25, 2025, an unauthorized actor infiltrated PCA’s internal network, exfiltrating sensitive personal and medical data of individuals. The compromised information includes names, addresses, dates of birth, Social Security numbers, medical records, and health insurance details. PCA confirmed the breach on October 23, 2025, after a forensic review, and began notifying affected individuals via mail on November 4, 2025. While only three Maine residents were officially reported, the total nationwide impact remains undisclosed. The breach triggered regulatory disclosures to the Maine Attorney General’s office, alongside federal notifications. PCA responded by securing systems, engaging cybersecurity experts, and offering 12 months of free credit monitoring (TransUnion Cyberscout), fraud assistance, and remediation services to victims. The incident exposes affected individuals to risks of identity theft, financial fraud, and targeted phishing attacks, with PCA advising vigilance through credit freezes, fraud alerts, and monitoring of financial accounts. A dedicated assistance line was established for inquiries.

Philadelphia Corporation for Aging (PCA), a nonprofit serving as Philadelphia’s Area Agency on Aging, experienced a data breach between July 10–25, 2025, where cybercriminals copied sensitive personal information of older adults and individuals with disabilities. The exposed data may include names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, health insurance details, and medical records. PCA completed its investigation by October 23, 2025, and notified affected individuals in November 2025, but did not disclose the total number of victims. The breach poses risks of identity theft, financial fraud, and medical fraud, prompting PCA to offer 12 months of free credit monitoring. Legal firms are investigating potential compensation claims for impacted individuals, highlighting the severity of the incident given the vulnerability of the affected population (elderly and disabled).