Families United Network, a Pennsylvania child welfare nonprofit based in Muncy, has disclosed that an unauthorized person accessed a single employee email account in December 2025 and downloaded its contents.
Families United Network’s Data Breach Investigation
Families United Network, which also goes by FUN, is a nonprofit social service agency headquartered in Muncy, Pennsylvania. It works with children and families through foster care, adoption, peer support and residential services. It has posted a Notice of Data Event on its website describing an incident involving one employee’s email account. The total number of people affected has not been published in the sources we reviewed.
According to the organization’s notice, it recently learned of suspicious activity within its email environment. It then took steps to confirm the security of its systems and began an investigation to determine the nature and scope of the event. That investigation confirmed that an unauthorized actor gained access to a single employee email account between December 19, 2025 and December 22, 2025, and downloaded the contents of the account.
Because the contents of an email account were downloaded, the organization then carried out a comprehensive review of the items involved. The purpose was to determine what information the files contained and whose information it belonged to. Email accounts at social service organizations can hold years of messages and attachments, such as forms, case-related documents, billing records and benefit paperwork, so a review like this can take many months before notices go out.
The organization says it has no indication of actual or attempted misuse of anyone’s information as a result of the event. It also says that its response included securing its systems, completing the investigation and reviewing the affected files. It states that it is reviewing existing security policies and has reinforced with its staff the importance of safeguarding information. The notice does not say how the account was accessed, and it does not name any group responsible.
The notice states that the information involved may vary by individual. The organization does not offer a single list that applies to everyone, which is why people who receive a letter should look for the specific data types named in their own notice. The notice also states that it was not delayed at the request of law enforcement. For help, the organization has set up a dedicated assistance line, listed on its notice page and open on weekdays during extended daytime hours Eastern Time.
The sources we reviewed do not state whether the organization is offering credit monitoring or identity protection services, and we are not assuming it does. The notice instead points people to general steps such as reviewing account statements, monitoring free credit reports, placing a fraud alert or a credit freeze, and contacting the Federal Trade Commission or their state Attorney General for more information about identity theft.
The notice includes state-specific information for residents of several jurisdictions, including the District of Columbia, Maryland, New Mexico, New York, North Carolina and Rhode Island. That is a normal feature of multi-state notices, since each state sets its own content requirements. It does not by itself mean the organization has reported the number of residents in each of those places, and no per-state counts were available to us.
For a nonprofit that serves children and families, the stakes of an email exposure can be high. The files in a mailbox may refer to minors, caregivers and household members, and in this case the notice lists medical and health insurance information alongside identity numbers. Combinations like that can be used to attempt identity theft, to file false insurance claims or to build convincing scam messages. This is general background about what such data can enable, not a statement that any misuse has occurred, and the organization says it has seen no indication of misuse.
Incidents involving a single compromised email account are common, and they are often tied to phishing or reused passwords, though the organization has not said what happened here. Where the account held sensitive attachments, the effect can be larger than the phrase “one account” suggests, because one mailbox can hold information about many people. People who had dealings with the organization, including families, foster and adoptive parents, and employees, should watch for a letter by mail.
When Did This Breach Occur?
Families United Network says an unauthorized actor accessed a single employee email account between December 19, 2025 and December 22, 2025 and downloaded the contents of the account. The organization has not stated when it first discovered the activity or when it began mailing notices, and the notice page does not give a date.
What Information Was Breached?
The organization’s notice says affected individuals’ names and the following types of information were present in the affected files: date of birth, driver’s license number, financial account information, health insurance information, medical information, Social Security number and state identification number. The information involved may vary by individual.
What You Can Do
If you are connected to Families United Network, consider these steps:
- Watch your mail for a notice, keep a copy, and read it for the specific types of information that apply to you.
- Check your credit reports for free at annualcreditreport.com, and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Review bank statements, insurance explanations of benefits and account activity for anything you do not recognize, and report it right away.
- Be cautious with unexpected calls, texts or emails about this incident, and do not share personal details with unsolicited contacts.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Families United Network
If you are connected to Families United Network and received a notice that your Social Security number, medical information, financial account details or other personal data was in the affected files, you may have legal options. Organizations are expected to protect the sensitive information they hold, and a lawsuit can help hold them accountable when they fall short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
