Easterseals Northeast Indiana Data Breach 2026 (INC RANSOM): 3,158 Disability Services Clients Exposed. 405 GB Leaked. What To Do

What happened

Easterseals Arc of Northeast Indiana (Easterseals NEI) is a Fort Wayne-based nonprofit, a regional affiliate of the national Easterseals network and affiliated with The Arc of Indiana. The organization provides early childhood intervention, ABA therapy, autism services, adult day programs, supported living, rehab/work services, and family support across northeast Indiana (Allen, Whitley, and Steuben counties — Fort Wayne, Columbia City, Angola).

The patient population skews highly vulnerable: children with developmental delays, adults with intellectual and developmental disabilities, and autism clients.

On September 4, 2025, Easterseals NEI detected suspicious network activity. On November 10, 2025, the INC RANSOM ransomware group posted Easterseals NEI on its dark-web leak site, claiming 405 GB of exfiltrated data including client records, medical forms, employee data, donor information, and financial statements.

Easterseals NEI filed with HHS OCR on February 16, 2026 and issued public notice via AccessNewswire on February 17, 2026 — confirming 3,158 affected individuals.

Note: One Cybernews headline conflated Easterseals NEI with a separate Rhysida attack on a different Easterseals affiliate — this is a distinct incident attributed to INC RANSOM.

A particularly vulnerable population

Easterseals NEI clients include children with autism spectrum disorder, developmental delays, and learning disabilities, plus adults with intellectual and developmental disabilities (IDD). The exposed records likely include:

• ABA therapy session notes documenting behavioral interventions
• IEP (Individualized Education Program) documentation tied to specific children
• Guardianship records for adult IDD clients
• Medicaid waiver enrollment information

These categories are inferred from the 405 GB leak description (“client records, medical forms”) and Easterseals NEI’s service lines. The official notice does not enumerate them explicitly.

What was stolen

Officially disclosed:

• Full name plus one or more of: Social Security number, health insurance information, medical diagnostic and treatment information, contact information, date of birth

Inferred from the 405 GB leak description (treat as unconfirmed until your notification letter is reviewed): ABA notes, IEP documents, guardianship records, Medicaid IDs.

The total affected per OCR (3,158) is materially smaller than the 405 GB leak claim, suggesting the leak includes employee, donor, and financial records in addition to client PHI.

What Easterseals NEI is offering

• Cyberscout (a TransUnion company) complimentary credit monitoring at no cost to individuals whose SSNs were involved
• Duration not specified in the public notice (typical industry default is 12 or 24 months — check your specific letter)
• Call center: 1-855-522-0942 (toll-free)

What to do

1. Enroll in Cyberscout monitoring if your SSN was in scope, through the activation code in your letter.
2. Place free credit freezes at Equifax, Experian, TransUnion as a baseline precaution.
3. File IRS Form 14039 if your SSN is confirmed in scope.
4. If you are the parent or legal guardian of a child or adult Easterseals NEI client, freeze your dependent’s credit at all three bureaus. Minor and IDD-adult identity theft creates long-tail synthetic-identity-theft risk.
5. Stop the ongoing flow of your disability-services data. HealthConsent files HIPAA restriction requests so the ABA, therapy, and Medicaid waiver data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches