The Lighthouse for the Blind, Inc., a Seattle-based nonprofit serving people who are blind, DeafBlind, or blind with other disabilities, has notified hundreds of individuals that their personal information was exposed after an unauthorized party accessed one of the organization’s email accounts. Organizations that manage sensitive medical, disability, and identification records for the people they serve have a responsibility to safeguard that data against unauthorized access.
The Lighthouse for the Blind, Inc.’s Data Breach Investigation
According to a notice filed with the Washington State Attorney General, The Lighthouse for the Blind identified suspicious activity related to one of its email accounts on April 20, 2026. The organization moved to secure its email environment and began an investigation with the help of outside specialists. That investigation determined that an unauthorized party had gained access to the email account between April 9, 2026, and April 20, 2026.
The Lighthouse for the Blind then conducted a comprehensive review of the emails contained in the affected account to determine what personal information was present and whose information may have been involved. That review process was completed on July 16, 2026, after which the organization began notifying potentially affected individuals. On September 3, 2026, The Lighthouse for the Blind sent written notice of the incident to 520 Washington residents.
Email account compromises like this one are among the most common ways sensitive personal and health information ends up exposed. Because employee inboxes often accumulate years of attachments, forms, and correspondence containing sensitive details, a single compromised account can expose a wide range of personal and medical data at once. Nonprofit and healthcare-adjacent organizations, including those serving people with disabilities, are frequent targets precisely because the records they retain, medical histories, insurance details, and government-issued identification numbers, are highly valuable to identity thieves and fraudsters.
The information that could have been subject to unauthorized access as a result of this incident includes each individual’s name, date of birth, driver’s license number, health insurance information, medical information, Social Security number, disability information, system access information, and reference to vision impairment. Because Social Security numbers and health information were both potentially involved, affected individuals face a heightened risk of both financial identity theft and medical identity theft, in which a fraudster uses a victim’s information to obtain medical services or prescriptions in their name.
Notification timelines for incidents like this one often span several months from initial detection to final notice, since organizations must first contain the incident, then conduct a document-by-document review to determine exactly whose information was involved before individualized notices can be sent. That gap between discovery and notification is a normal part of the investigative process, not necessarily a sign of delay or mishandling, though it does mean affected individuals may not learn of a breach until months after the underlying incident occurred.
Business email compromise incidents, where an attacker gains unauthorized access to an employee’s inbox, remain one of the most frequently reported categories of data breach across every industry, in part because a single mailbox can serve as a gateway to years of accumulated attachments, forms, and internal correspondence. For organizations that serve people with disabilities, that accumulated correspondence can include intake paperwork, medical documentation, and eligibility records that would otherwise never be stored in one place. Once an attacker has access to that kind of email account, sorting out exactly which individuals are affected and what specific data elements were exposed is a labor-intensive process, which is part of why organizations often take weeks or months to complete a full review before notifying anyone.
Exposure of Social Security numbers, driver’s license numbers, and health-related information in combination is considered especially high-risk by identity theft experts, because that combination gives a fraudster nearly everything needed to open new financial accounts, file fraudulent tax returns, or seek medical treatment or prescriptions under someone else’s identity. Disability status and medical information carry an additional layer of sensitivity beyond a typical financial data breach, since that information can be used for targeted scams that exploit a person’s specific circumstances, such as fraudulent offers for medical equipment, home health services, or benefits assistance aimed at people already navigating disability-related systems.
Federal and state regulators have increasingly emphasized that organizations handling protected health information and disability-related records are expected to maintain heightened safeguards, given how attractive that data is to criminals compared to more generic contact information. Individuals affected by breaches involving both identity and health data are generally advised to monitor not just their credit files but also their insurance and medical billing statements, since medical identity theft can be harder to detect through a standard credit report alone and may not surface until a fraudulent claim or bill appears.
When Did This Breach Occur?
The unauthorized access occurred between April 9, 2026, and April 20, 2026. The Lighthouse for the Blind identified the suspicious activity on April 20, 2026, and completed its review of the affected email account on July 16, 2026. Written notice to affected Washington residents was provided on September 3, 2026.
What Information Was Breached?
The Lighthouse for the Blind reported that the information that could have been subject to unauthorized access includes names, dates of birth, driver’s license numbers, health insurance information, medical information, Social Security numbers, disability information, and system access information, along with references to vision impairment. The organization is offering one year of complimentary credit monitoring and identity restoration services through Epiq to affected individuals.
What You Can Do
If you received a notice from The Lighthouse for the Blind, consider taking the following steps:
- Enroll in the complimentary credit monitoring and identity restoration services offered in the notification letter.
- Review your financial and medical account statements regularly for unfamiliar activity.
- Place a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion.
- Monitor your explanation of benefits statements from your health insurer for services you did not receive.
- Report any suspected identity theft or fraud to the Federal Trade Commission and your state attorney general.
File a Data Breach Lawsuit Against The Lighthouse for the Blind, Inc.
If you received a notice that your personal or health information was exposed in The Lighthouse for the Blind’s data breach, you may be entitled to compensation. Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
