Center for Living & Working, Inc. data breach

What we know

Center for Living & Working, Inc. operates as a vital human services and healthcare support organization, dedicated to assisting individuals with disabilities, seniors, and those requiring long-term care management. Because of its mission to promote independent living and provide comprehensive personal care assistance, the organization functions as a central repository for an immense volume of deeply sensitive information. This includes not only standard administrative and employment records but also comprehensive personal health data, daily living assistance assessments, Medicaid and Medicare documentation, and detailed care plans for vulnerable populations across Massachusetts. The nature of these operations requires the collection and retention of records that demand the highest levels of privacy and digital safeguarding. In 2025, Center for Living & Working, Inc. reported a significant cybersecurity incident to the Massachusetts Attorney General, placing current and former clients, caregivers, and personnel on high alert. While organizations in the healthcare and social services sectors are frequent targets of sophisticated cybercriminal enterprises, incidents of this nature typically involve unauthorized access to internal network environments, potential exfiltration of database files, or targeted ransomware deployments. Breaches compromising healthcare-adjacent non-profits often exploit legacy IT infrastructure, third-party vendor vulnerabilities, or phishing vectors designed to compromise administrative credentials, allowing malicious actors to dwell undetected within sensitive networks for extended periods. The exposure resulting from this incident threatens individuals with severe, multi-faceted harms due to the deeply personal nature of the compromised records. When categories such as Social Security numbers, full names, dates of birth, health insurance details, and specific medical or disability assessment histories are compromised, the risk profile extends far beyond standard financial fraud. Exposed health and demographic data can be leveraged by bad actors to commit medical identity theft—where unauthorized parties obtain medical care or bill insurance under a victim's name, potentially corrupting medical history files and creating dangerous discrepancies in future care. Furthermore, the combination of identifiers stolen in such breaches frequently enables criminals to open fraudulent lines of credit, intercept government benefits, and execute targeted phishing scams aimed at vulnerable individuals. Under federal and state law, including the Health Insurance Portability and Accountability Act (HIPAA) and the Massachusetts Data Security Regulations (201 CMR 17.00), organizations entrusted with protected health information and sensitive personal data have a strict legal obligation to implement robust administrative, physical, and technical safeguards. These mandates require continuous network monitoring, data encryption both in transit and at rest, multi-factor authentication, and rigorous employee security training. The occurrence of a data breach of this scale strongly suggests potential systemic failures in meeting these regulatory standards, indicating that existing security protocols were inadequate to prevent unauthorized access or fail to detect intrusions in a timely manner. Receiving an official data breach notification letter from Center for Living & Working, Inc. serves as formal legal acknowledgment that your private information was compromised due to corporate security shortcomings. Under modern jurisprudence, the receipt of such a notice and the subsequent threat of impending misuse provides affected individuals with the legal standing necessary to pursue accountability through class action litigation. Participating in a class action lawsuit requires no upfront financial investment, as our firm handles these matters on a strict contingency fee basis—meaning you pay nothing unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.