Kids Company Data Breach Compromises PHI and PII

Kids Co., a Seattle-based nonprofit child care organization formally known as Evergreen Children's Association, disclosed a data breach that occurred in November 2025.

The organization, founded in 1989, provides preschool, before- and after-school care and summer day camp programs for children ages 3 to 12 at public school sites in Seattle and Mercer Island, Washington.

On or about Nov. 12, 2025, Kids Co. became aware of suspicious system activity affecting its network. Kids Co. launched an investigation to confirm the full nature and scope of the activity.

The investigation determined that an unauthorized actor accessed or acquired certain data on Kids Co.'s network between Nov. 11, 2025, and Nov. 12, 2025.

Following this discovery, Kids Co. undertook a thorough review of the data at risk to identify what information was contained in the affected files and which individuals it related to.

The types of personal information that could have been subject to unauthorized access included names, Social Security numbers, driver's license or Washington ID card numbers, financial and banking information, passport numbers, health insurance policy or ID numbers and medical information.

So far, two Massachusetts residents and 511 Washington residents were identified as affected by the incident. Kids Co. began notifying affected individuals on July 2, 2026.

Kids Co.'s response to the breach

Kids Co. is offering free credit monitoring through Cyberscout, a TransUnion company, for 12 to 24 months. To enroll, affected individuals can visit the Cyberscout activation page and enter the unique code included in their notification letter. Enrollment must be completed within 90 days of the date of the letter.

Kids Co. has set up a dedicated assistance line at 1-800-405-6108, available from 8 a.m. to 8 p.m. EST, Monday through Friday, excluding holidays. Affected individuals with questions about the incident can call this number for further information.