Maryville Academy, a nonprofit serving children and families in Illinois, identified suspicious activity on its information technology systems in mid-2024. Following an internal review supported by outside forensic specialists, the organization confirmed that some of the affected systems stored documents containing protected health information belonging to clients. Organizations entrusted with sensitive medical and personal records have a responsibility to secure that data and to notify those affected promptly and clearly once a breach is confirmed.
Maryville Academy’s Data Breach Investigation
Maryville Academy detected the suspicious activity on July 15, 2024, and immediately activated its incident response protocols, notifying law enforcement and retaining external computer forensic specialists to determine the scope of the intrusion. The investigation determined that an unauthorized party gained access to certain systems that stored documents containing protected health information. A subsequent, lengthy review process was undertaken to identify exactly which individuals and which categories of personal information were involved, a process Maryville says was completed on May 7, 2025.
Because Maryville Academy operates across multiple states and its notification obligations extend to residents nationwide, the organization has been filing notices with state attorneys general on a rolling basis as its review of affected populations in each jurisdiction is finalized. A notice was filed with the Vermont Attorney General’s office identifying at least one Vermont resident affected, while a separate state breach reporting disclosure identified dozens of Massachusetts residents impacted by the same incident. This kind of staggered, state-by-state notification is a normal part of the regulatory process for organizations with clients spread across many states, and does not mean multiple separate breaches occurred, just that each state’s disclosure reflects only the residents of that particular state.
Data breaches involving healthcare and social-services nonprofits are an increasingly common target for cybercriminals, in part because these organizations often store large volumes of sensitive personal and medical records but may have more limited cybersecurity budgets than larger healthcare systems or corporations. Attackers who gain access to protected health information can use it for a wide range of fraud, including opening new credit lines, filing fraudulent tax returns, and even attempting medical identity theft to obtain healthcare services or prescriptions in a victim’s name. The combination of Social Security numbers, government identification numbers, and medical history data exposed in this incident is especially valuable to identity thieves because it can support long-term, hard-to-detect fraud schemes that go well beyond simple credit card misuse.
Individuals whose information may have been affected should treat any notice they receive from Maryville Academy seriously, and should not assume that a lack of direct notice means their data was not involved, particularly if they interacted with Maryville Academy in any capacity during or before the relevant time period.
When Did This Breach Occur?
Maryville Academy identified the suspicious activity on its systems on July 15, 2024. The subsequent forensic investigation and document review process to determine which individuals and data types were affected was completed on May 7, 2025, after which the organization began issuing notifications. State-specific regulatory filings, including the Vermont Attorney General notice, have continued on a rolling basis into 2026 as Maryville completes notification for residents of additional states.
What Information Was Breached?
According to Maryville Academy’s own notice, the affected systems stored documents containing protected health information, which may have included individuals’ names in combination with one or more of the following: addresses, dates of birth, Social Security numbers, financial account information, passport numbers, driver’s license or other government-issued identification numbers, health insurance information, and medical information such as treatment history, diagnoses, and other medical records.
What You Can Do
If you received a notice from Maryville Academy or believe you may have been affected by this breach, consider taking the following steps:
- Carefully review any notice you receive and keep a copy for your records
- Enroll in any free credit monitoring or identity protection services offered
- Regularly review your credit reports, bank statements, and health insurance statements for unfamiliar activity
- Consider placing a fraud alert or credit freeze with the major credit bureaus
- Contact your health insurance provider if you notice any unfamiliar claims or services on your account
- Report any suspected identity theft to the Federal Trade Commission at consumer.ftc.gov
File a Data Breach Lawsuit Against Maryville Academy
If your personal or medical information was exposed as a result of this breach, you may be entitled to compensation. Companies and organizations that collect and store sensitive personal data are legally obligated to protect it, and when they fail to do so, affected individuals may have grounds for legal action.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
