Indiana Family & Social Services Administration Data Breach — Official Case File

From the AG filing description

The Indiana Family & Social Services Administration (FSSA) serves as a critical state agency responsible for designing, funding, and administering a vast array of social and healthcare programs for vulnerable residents throughout Indiana. This encompasses the management of Medicaid, mental health services, disability supports, child welfare programs, and various public assistance initiatives designed to help low-income families secure food, housing, and healthcare. Because of its core mission, the agency collects, processes, and retains exceptionally sensitive information regarding millions of citizens, making it an indispensable pillar of the state's social safety net while simultaneously establishing it as a massive repository of deeply personal data. In 2025, the agency reported a significant cybersecurity incident to the Indiana Attorney General's office, prompting widespread concern among residents whose personal and programmatic records were entrusted to the state. For large governmental and social service entities, breaches of this magnitude frequently stem from sophisticated cyberattacks, vulnerabilities in legacy digital infrastructure, unauthorized access to centralized citizen databases, or third-party vendor compromises within the state's sprawling digital supply chain. When malicious actors infiltrate these networks, they gain unfettered access to integrated agency platforms that house years of historical records, public assistance applications, and inter-agency communications. The exposure resulting from this security failure implicates a dangerous array of personally identifiable information, including full names, dates of birth, Social Security numbers, government-issued identification details, financial assistance records, and confidential health or benefit eligibility histories. The compromise of this data creates severe, multi-faceted risks for affected individuals. Social Security numbers and dates of birth form the foundational elements required for synthetic identity theft and financial fraud, while leaked public assistance records expose vulnerable citizens to targeted phishing schemes, fraudulent benefit applications filed in their names, and invasive medical privacy violations that can take years to remediate. As a state administrative body entrusted with confidential citizen data, the Indiana Family & Social Services Administration is bound by stringent statutory and regulatory obligations under Indiana state data protection laws, as well as federal frameworks governing health and public welfare data such as HIPAA and the Privacy Act. These legal standards require covered entities to implement rigorous administrative, physical, and technical safeguards—including robust encryption, continuous network monitoring, multi-factor authentication, and strict vendor access controls—to prevent unauthorized disclosures. The occurrence of a data breach strongly indicates a failure to maintain these mandatory security protocols, leaving the agency vulnerable to legal scrutiny and accountability. Receiving an official data breach notification letter from the Indiana Family & Social Services Administration serves as formal legal confirmation that your confidential records were compromised as a result of the agency's security failures. Under modern class action jurisprudence, the receipt of this notice establishes legal standing to pursue a claim for damages related to increased risk of identity theft, loss of privacy, and out-of-pocket mitigation expenses, without requiring proof that financial loss has already occurred. Our firm is actively investigating this data breach and evaluates potential claims on a contingency fee basis, meaning there are never any upfront costs or out-of-pocket expenses for affected individuals unless we successfully recover compensation on your behalf.