HELP Foundation has been named in an unconfirmed report of a possible cyberattack. This page explains what has been reported, what is not known and what the people it serves, their families and its employees can do now.
The facts below come from a third-party monitoring report and may change if the organization confirms or denies the claim.
HELP Foundation’s Data Breach Investigation
HELP Foundation is an Ohio-based nonprofit that supports and provides services for people with disabilities. It describes its work as residential support for children and adults with intellectual and developmental disabilities, along with summer programming for children and day support for adults. Organizations like this hold records that are both personal and sensitive, often covering people who cannot easily manage their own affairs.
According to a November 12, 2026 post on the dark web monitoring site Ransomware.live, the ransomware group INC Ransom was behind a suspected attack on the organization. The post estimated that the attack took place three days earlier, which would be November 9, 2026. A cybersecurity blog separately reported that the same group claimed responsibility for an attack on HELP Foundation.
It is important to be clear about what this is. A listing on a ransomware group’s leak site is a claim made by the attackers. It has not been verified, and HELP Foundation has not confirmed publicly that a breach occurred. Claims of this kind can be accurate, incomplete or overstated. Until the organization says more, the situation should be treated as a possible incident rather than an established one.
The scope of the reported attack is also unknown. At the time the source was published, no additional information was available about the nature or scope of the incident. The post does not say what information the group claims to hold, how many people may be involved or whether any data has been released. The category of impacted data is still to be determined, and this page does not guess at it.
Ransomware groups generally work by breaking into a network, copying files and then threatening to publish them unless a payment is made. Being named on a leak site is often the first public step in that process. If files were taken, the information at risk would depend on what the organization stored, which for a care provider could include identity details, contact information for families and guardians, and records connected to services and care.
For an organization that serves people with disabilities, a breach carries added concern. The people receiving services may rely on family members or guardians to watch their accounts and mail, and their information may be used by criminals for a long time before anyone notices. Children’s information is also attractive to identity thieves because misuse can go undetected for years.
If you or your loved one receives services from HELP Foundation, or if you are a current or former employee, there is no need to assume your information was taken. There is also no harm in taking sensible precautions now. Watch for unexpected mail, bills or calls connected to your loved one’s name, and be careful with messages that claim to come from the organization and ask for personal details or payment.
Employees deserve the same caution. Staff at residential and day programs are often asked for identity documents, tax details and bank information for payroll, and that information can be used for tax fraud or account takeover. Current and former workers should keep an eye on their own accounts and be wary of messages that mention their employment.
Families and guardians may want to consider placing a credit freeze for an adult who receives services, and for a child, asking the credit bureaus about a protected record. These steps are free and can stop a thief from opening accounts in a person’s name. They are worth considering even before the facts are confirmed, because they are simple and can be reversed when needed.
If the organization confirms a breach, it will normally be required to send written notice to the people affected and to file reports with state regulators. Keep any notice you receive. Legal help is available for people who want to understand whether a claim may be possible as more becomes known about the incident.
When Did This Breach Occur?
The monitoring post was dated November 12, 2026, and it estimated that the suspected attack occurred about three days earlier, on November 9, 2026. Those dates come from a third-party report and the attackers’ claim, not from the organization. HELP Foundation has not confirmed when, or whether, an incident occurred, and no discovery date or notice date has been made public.
What Information Was Breached?
It is not yet known what information, if any, was involved. The source lists the impacted data as to be determined, and the organization has not said what a possible attack may have reached. If the claim is confirmed, a care provider could hold identity details, family contact information and records connected to services, but that is a general observation and not a finding about this incident. Read any notice you receive to see which items apply to you.
What You Can Do
If you received a notice related to HELP Foundation or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If a loved one who receives services may be affected, consider a credit freeze for an adult or a protected credit record for a child, and watch mail addressed to them for unfamiliar bills or offers.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against HELP Foundation
Attorneys are looking into the reports of a possible data breach at HELP Foundation and want to hear from employees, people who have received its services and their families who believe information may have been put at risk. A lawsuit has not been confirmed, and the organization has not confirmed a breach. Whether you can seek compensation depends on what the organization ultimately confirms. If you received a notice or believe information was exposed, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
