Alma Family Services has reported a data breach to federal regulators that affected 2,753 people. The incident was filed as a hacking or IT incident involving a network server. Healthcare and family service providers hold sensitive personal information, and they carry a responsibility to keep that information secure and to tell people promptly when it may have been exposed.
Alma Family Services’s Data Breach Investigation
Alma Family Services reported a data breach to the U.S. Department of Health and Human Services Office for Civil Rights on September 10, 2026. The filing lists the organization as a healthcare provider located in California and states that 2,753 individuals were affected. The type of incident is categorized as hacking or an IT incident, and the location of the breached information is listed as a network server. Those are the core facts available in the public federal record, and Alma Family Services has not, as far as public sources show, released a detailed narrative of how the incident unfolded.
A hacking or IT incident involving a network server generally means that someone outside the organization gained unauthorized access to a computer system where files are stored, rather than a lost laptop or a misdirected mailing. Network servers at healthcare and behavioral health providers often hold a wide range of records, including intake forms, billing files, scheduling information, and clinical documentation. Which of those categories were actually stored on the affected server, and which were accessed, has not been publicly disclosed for this incident. This page will be updated if additional details become available.
Under the HIPAA Breach Notification Rule, a covered entity must report a breach affecting 500 or more individuals to HHS and must notify each affected person without unreasonable delay, no later than 60 days after discovering the breach. The September 10, 2026 submission date therefore marks when the report reached federal regulators, not necessarily when the intrusion itself occurred or when it was first detected. In many healthcare breaches, the unauthorized access happens weeks or months before a report is filed, because the organization must first contain the incident, bring in forensic specialists, and then review the affected files to work out whose information was involved.
The federal portal lists the entity type as a healthcare provider, which is a broad category. Healthcare providers are a frequent target of cyberattacks because their systems can contain the kind of information that is difficult to replace and valuable to criminals, such as Social Security numbers, dates of birth, insurance details, and treatment information. Unlike a credit card number, which can be cancelled and reissued, a person’s medical history and identifiers stay with them for life. That is why exposure of health-related records can create a long-lasting risk of identity theft, medical identity fraud, and convincing phishing messages that reference real details about a person’s care.
Because the HHS filing does not describe the specific data elements involved, it would be inaccurate to say which types of personal information were taken from Alma Family Services. Patients and clients who receive a notification letter should read it carefully, since the letter is the most reliable place to learn exactly which categories of information the organization says were affected, what protective services are being offered, and what deadline applies to enrolling in them. People who believe they may have been affected but have not received a letter can contact the organization directly to ask whether their information was involved.
Breaches reported through the HHS portal also tend to follow a familiar pattern after the initial filing. Individual notification letters are mailed, state attorneys general may receive copies, and in some cases additional details emerge later through regulatory filings, sample notice letters, or the organization’s own website. Anyone affected can benefit from keeping a copy of any notice they receive, noting the date it arrived, and keeping records of any suspicious activity they notice afterward. Those records can be useful if you later decide to speak with an attorney about your options.
Organizations that provide health and family services collect information from people at some of the most personal moments in their lives, and they are expected to protect that information with appropriate technical and administrative safeguards. When a network server holding that information is compromised, the people whose records were stored there are the ones left to deal with the consequences, including the time and stress of monitoring accounts and credit reports. If you were a patient or client of Alma Family Services and received a notice about this incident, it is worth taking the steps listed below and learning more about your rights.
When Did This Breach Occur?
Alma Family Services submitted its breach report to the U.S. Department of Health and Human Services on September 10, 2026. The date on which the unauthorized access began, and the date the organization discovered it, have not been publicly disclosed. Individuals affected by the incident should receive a written notification from the organization describing the timeline in more detail.
What Information Was Breached?
The federal filing states that the breached information was located on a network server and that 2,753 individuals were affected. It does not list the specific types of personal or health information involved. Alma Family Services has not publicly confirmed which data elements were exposed, so the contents of your individual notification letter are the best source for what applies to you.
What You Can Do
If you received a notice from Alma Family Services, or believe your information may have been involved, consider taking the following steps:
- Read your notification letter carefully and enroll in any credit monitoring or identity protection services offered before the stated deadline.
- Place a fraud alert or security freeze on your credit file with Equifax, Experian, and TransUnion.
- Request and review a free copy of your credit report at annualcreditreport.com.
- Review explanation of benefits statements and account statements for anything you do not recognize.
- Be cautious of unexpected calls, emails, or texts that mention your health care or personal details.
- Report suspected identity theft to your state Attorney General and the Federal Trade Commission.
File a Data Breach Lawsuit Against Alma Family Services
If you received a data breach notification connected to Alma Family Services, you may be entitled to compensation. Organizations that collect and store sensitive health and personal information have a responsibility to keep it secure, and when that trust is broken, affected individuals deserve answers and accountability.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
