A nonprofit organization in California has alerted thousands of individuals after a cybersecurity incident exposed highly sensitive personal data. The Children’s Council of San Francisco, a nonprofit that supports families with childcare resources, recently confirmed that a data breach compromised the Social Security numbers of more than 12,000 people.
The breach highlights the growing cybersecurity risks facing nonprofit organizations and raises concerns about identity theft and data privacy.
What Happened
According to reports, unauthorized actors gained access to the Children’s Council of San Francisco’s network in August 2025, leading to a data security incident that went undetected for several months.
The organization later conducted a detailed investigation with cybersecurity specialists to determine the scope of the breach. By February 23, 2026, investigators concluded that sensitive personal information had been accessed by an unauthorized party.
After confirming the extent of the incident, the nonprofit began notifying affected individuals and informing authorities about the breach.
Over 12,600 People Affected
The breach impacted 12,655 individuals, whose personal information was stored within the organization’s systems.
The compromised data reportedly included:
- Full names
- Social Security numbers (SSNs)
While other financial or medical information was not reported to be exposed, the leak of Social Security numbers alone presents a serious risk because the numbers can be used for identity theft and financial fraud.
Possible Link to Cyberattack
Security researchers have also noted that a ransomware group known as SafePay previously claimed responsibility for attacking the organization in August 2025. The group threatened to release sensitive data if its demands were not met, though the full details of the attack have not been officially confirmed by the nonprofit.
If the claim is accurate, the breach may be connected to a broader ransomware campaign targeting organizations with valuable personal data.
Steps Taken by the Organization
Following the discovery of the breach, the Children’s Council of San Francisco took several measures to mitigate potential harm:
- Securing affected systems
- Conducting a forensic investigation
- Reviewing compromised files
- Notifying affected individuals
The organization is also offering 12 months of credit monitoring and identity protection services to help victims monitor potential misuse of their personal information.
Risks for Victims
Even when no immediate misuse of data is detected, breaches involving Social Security numbers pose long-term risks. Because SSNs rarely change, criminals can use them years later to commit identity theft, open fraudulent accounts, or conduct financial scams.
Experts advise anyone affected by such incidents to:
- Monitor credit reports regularly
- Set up fraud alerts or credit freezes
- Watch for suspicious financial activity
- Take advantage of free identity monitoring services
Growing Cybersecurity Threats to Organizations
The incident is part of a broader trend of cyberattacks targeting organizations that store large volumes of personal information. Nonprofits, healthcare institutions, and government entities are increasingly becoming targets because they often manage sensitive data but may have limited cybersecurity resources.
As cybercriminals continue to exploit security weaknesses, incidents like this serve as a reminder of the importance of stronger data protection practices and faster breach detection.
Conclusion
The Children’s Council of San Francisco data breach demonstrates how a single cybersecurity incident can expose thousands of individuals to potential identity theft. Although the organization has taken steps to notify victims and offer support services, the exposure of Social Security numbers means those affected may need to remain vigilant for years to come.
Strengthening cybersecurity defenses and improving early detection systems will be essential for preventing similar incidents in the future.
