On May 22, 2025, Family & Community Services Inc. (FCS) discovered that its systems may have been compromised by an unauthorized actor. The breach was first detected internally, prompting FCS to engage a third-party cybersecurity firm to conduct an investigation. The investigation and review is still ongoing, however Family & Community Services has chosen to notify the public, as there is potential that sensitive personal information has been accessed.
The organization has not yet determined the exact number of individuals affected or the full scope of the data involved. These types of data breaches often compromise both personally identifiable information (PII) and protected health information (PHI).
Exposed information may include names, addresses, dates of birth, Social Security numbers, driver's license numbers, health information, treatment records and financial information. Family & Community Services is working to identify specific individuals and the types of information that may have been hacked.
A ransomware group known as Qilin has claimed responsibility for the cyberattack. Qilin posted about the breach on a dark web forum on July 2, 2025, stating they had obtained organizational data.
Family & Community Services also published a Notice of Data Security Incident on its website.
Those whose sensitive information is confirmed to be impacted will receive a formal notice letter detailing the types of data involved.
In response to the incident, FCS has taken steps to secure its systems. Those whose sensitive information is confirmed to be impacted will receive a formal notice letter detailing the types of data involved.
If you believe your personal information may have been compromised in this breach:
Family & Community Services also set up a dedicated call center for individuals with questions or concerns at 1-888-844-1165, available Monday through Friday from 8 a.m. to 11 p.m. and Saturday from 9 a.m. to 6 p.m. Eastern time.
For more information about the organization and its programs, visit the Family & Community Services website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.