City of Franklin Data Breach 2025: 3,233 Affected · Hacking/IT Incident · WI. Filed With HHS OCR. What To Do.

The City of Franklin, Wisconsin filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on July 03, 2025, reporting 3,233 affected individuals in a Hacking/IT Incident event at a Network Server. The OCR portal entry classifies the city as a Healthcare Provider, consistent with the City of Franklin Health Department’s role as a HIPAA-covered entity.

The underlying incident was a network intrusion that the city says it first detected on or about August 15, 2024, when an unauthorized third party accessed a server holding records reportedly dating back several decades. Forensic investigators worked for roughly nine months to identify exactly whose information was involved before the city filed its OCR notification and began mailing individual letters in July 2025.

Timeline

• August 15, 2024 — An unauthorized third party accessed a City of Franklin network server. The city detected the intrusion the same day, secured its network environment, and engaged independent IT and forensic investigators. The FBI was notified and opened an investigation.
• August 2024 through May 2025 — Forensic review of the affected server, including data-mining of records the city says go back to the 1960s, to determine what categories of personal information were involved and which individuals were affected.
• May 19, 2025 — Forensic investigation concluded. The city then began preparing notification letters, running a National Change of Address search on the resulting list, and contracting a mail vendor.
• July 03, 2025 — HIPAA breach notification filed with HHS Office for Civil Rights for 3,233 individuals (Hacking/IT Incident at Network Server).
• July 14, 2025 — City of Franklin published its public FAQ on the incident and began mailing individual notification letters offering complimentary identity-protection services through Cyberscout (a TransUnion company).

The eleven-month gap between detection and notification is on the long end of what HIPAA’s 60-day clock contemplates. The city’s position is that the clock runs from the date the breach is discovered, which it dates to the conclusion of the forensic review on May 19, 2025, rather than the August 15, 2024 access date.

What was exposed

According to the City of Franklin’s public FAQ and notification letters, the categories of personal information that may have been accessed include:

• Name
• Date of birth
• Social Security number
• Taxpayer identification number
• Other personal information held on the affected city server

The HHS OCR portal classifies the breach location as Network Server. The city has stated that as of its public disclosure, there was no evidence that any of the involved information had been misused.

What the City of Franklin is offering

Affected individuals were offered complimentary identity-protection services through Cyberscout, a TransUnion company. The city’s notification letters include an enrollment code and a toll-free number for questions about the incident and enrollment.

The city has also said it implemented additional safeguards and enhanced security measures following the incident, working with outside IT specialists.

Class-action posture

As of this writing, no consolidated class action specific to the City of Franklin incident has been publicly confirmed filed. Several plaintiffs’ firms that monitor municipal and HIPAA-covered-entity breaches have noted the incident, but no docket has been verified. The FBI’s investigation into the responsible party remains open and no attribution has been made public.

What to do if you may be affected

• Activate the offered identity-protection coverage. If you received a notification letter from the City of Franklin, enroll with Cyberscout using the code on the letter. It is paid for and adds nothing to your risk profile.
• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against identity theft. A credit freeze and identity monitoring are complementary, not redundant.
• File your tax return early. Because taxpayer identification numbers were among the data categories, filing before a bad actor can submit a fraudulent return is a meaningful protection. Consider requesting an IRS Identity Protection PIN.
• Watch for targeted phishing. Because the attacker may have accurate name, date-of-birth, and SSN information, follow-on phishing or impostor calls may reference real details. Do not click links or call numbers from any message claiming to be from the City of Franklin. Go to franklinwi.gov directly or use the toll-free number on your notification letter.
• Keep the notification letter. It establishes your standing if a class action is later filed and certified.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• City of Franklin official FAQ on the data security incident (July 14, 2025) — the entity’s primary public statement, hosted on franklinwi.gov.
• CBS 58 News coverage of the City of Franklin breach — local broadcast reporting on the notification, including data categories and FBI involvement.
• Milwaukee Journal Sentinel summary via Worldnews — newspaper coverage of the city’s July 16, 2025 disclosure.
• Wisconsin DATCP consumer data-breach repository — Wisconsin Department of Agriculture, Trade and Consumer Protection breach-notice index.