Perseus House, a nonprofit youth and family services organization based in Erie, Pennsylvania, has disclosed a data breach affecting 969 people. The incident involved copied files that may include health, financial and identity information tied to current and former residents and employees.
Perseus House’s Data Breach Investigation
Perseus House, Inc. provides residential and educational programs for at-risk youth and families in Erie and across Pennsylvania. According to a public notice the organization posted on its website in January 2026, it became aware of suspicious activity and began an investigation into the nature and scope of what was happening. That investigation determined that an unauthorized actor gained access to certain Perseus House systems and copied files on or around November 29, 2025.
The organization says it reported the event to federal law enforcement, acted quickly to secure its systems and keep its services running, and continues to evaluate and strengthen its technical safeguards. At the time of the web notice, Perseus House said it was still conducting a comprehensive review of the potentially affected files to learn what types of information they held and who that information belonged to.
The incident was later reported to the U.S. Department of Health and Human Services Office for Civil Rights on February 20, 2026. The federal breach listing records it as a hacking or IT incident involving a network server, with 969 people affected. Perseus House has also been named in filings with a number of state attorneys general, which is common when an organization has to notify residents of more than one state.
The notice describes the people involved as certain current and former residents, employees and other individuals connected to Perseus House. That mix matters. Records for youth in residential programs can combine identity details with treatment and insurance information, while employee records tend to carry banking and tax-related identifiers. A single set of copied files can therefore expose very different kinds of sensitive data depending on who a person was to the organization.
Perseus House says the types of information affected vary by individual. Based on the organization’s own notice, they could include dates of birth, Social Security numbers, financial account information such as personal banking numbers, medical information that may include diagnoses, treatments and providers, health insurance information such as group or policy numbers, home addresses and telephone numbers. We have not seen a public statement of the cause of the intrusion, whether a ransom demand was made, or whether the copied data has appeared anywhere online, and none of those points is assumed here.
Organizations that serve children and families, including behavioral health and residential care providers, are attractive targets for data thieves because their files can hold a lot of high-value information in one place. A Social Security number combined with a date of birth, a home address and health insurance details gives a criminal what is needed to open accounts, file false tax returns or bill medical services in someone else’s name. Medical identity theft in particular can be slow to surface, since the first sign may be a bill or an insurer’s explanation of benefits for care that was never received.
Notably, the notice offers no mention of credit monitoring or identity protection services. Individuals who may be affected are instead encouraged to remain vigilant by reviewing account statements, credit reports and explanations of benefits for unusual activity, and to report anything suspicious to their health care provider, insurance company or financial institution. A dedicated contact was set up through the organization’s Human Resource Department for questions.
For people who were placed with Perseus House as young people, there is an added concern. A child’s Social Security number can be misused for years before anyone notices, because no one is regularly checking a minor’s credit. Former residents who are now adults, and the families of those who were minors at the time, may want to check whether a credit file exists in the affected person’s name and consider placing a freeze.
Class Action U is following this incident. If you received a notice from Perseus House or believe you were affected, understanding what the notice says and acting early to protect your accounts are the most useful first steps. You do not need to wait for more information to be published before taking those steps, and keeping records of any suspicious activity will matter if you later decide to pursue a claim.
When Did This Breach Occur?
Perseus House says an unauthorized actor gained access to its systems and copied files on or around November 29, 2025.
The organization posted a notice about the event on its website in January 2026. The incident was reported to the U.S. Department of Health and Human Services on February 20, 2026.
Perseus House has not publicly stated the exact date it first noticed the suspicious activity, so only the November 29, 2025 access date is given here.
What Information Was Breached?
The types of information involved vary by person. Perseus House lists dates of birth, Social Security numbers, financial account information (personal banking numbers), medical information, health insurance information, home addresses and telephone numbers as possibilities.
The medical information described may include diagnoses, treatments and provider details. The organization says the people potentially affected include current and former residents, employees and other individuals.
What You Can Do
Perseus House encourages anyone who may be affected to watch their accounts closely, and the organization lists a Human Resource Department phone line for questions. These steps can help:
- Review bank and card statements, credit reports and insurance explanations of benefits for charges or services you do not recognize.
- Request your free credit reports from each major bureau at annualcreditreport.com.
- Consider a free fraud alert or credit freeze, including for a minor whose information may have been involved.
- Report anything suspicious to your health care provider, insurer or financial institution right away.
- Be cautious with calls, texts and emails that reference this incident, and confirm them through an official contact first.
File a Data Breach Lawsuit Against Perseus House
Data breach claims generally rest on whether an organization took reasonable steps to protect the sensitive information it held. Because this incident may involve health records, banking details and Social Security numbers of people who were often minors or employees, the stakes for those affected can be high.
People affected may be able to seek compensation for out-of-pocket costs, time spent protecting themselves, and the ongoing risk of identity theft. A lawyer experienced in class actions can review your situation and explain your options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
