National Council for Community Development, Inc. d/b/a Grow America data breach

What we know

National Council for Community Development, Inc., operating under the well-known trade name Grow America, plays a critical role in urban development, neighborhood revitalization, and community-based economic programming across the United States. As an organization dedicated to driving investment, managing community development funds, and administering comprehensive housing and employment initiatives, Grow America routinely collects, processes, and maintains vast repositories of sensitive personally identifiable information (PII) and financial records. The organization routinely handles intricate data pertaining to program participants, local stakeholders, employees, and financial partners, making its digital infrastructure a centralized repository for highly confidential information. In 2025, the organization reported a significant cybersecurity incident to the Massachusetts Attorney General, raising severe concerns among the thousands of individuals whose data was entrusted to its systems. While details surrounding the precise vector of the intrusion continue to be scrutinized, security incidents affecting community development corporations and financial intermediaries frequently involve sophisticated cyberattacks, such as unauthorized network access, ransomware deployment, or vulnerabilities within third-party vendor platforms. In the context of organizations managing community and economic development funding, threat actors often target legacy databases or employee credentials to extract high-value personal and financial dossiers. The exposure resulting from the Grow America data breach encompasses a dangerous amalgamation of sensitive data types, including full names, dates of birth, Social Security numbers, banking details, and comprehensive financial or tax records. The compromise of this specific category of information exposes victims to severe, long-term risks, including targeted identity theft, fraudulent credit card applications, unauthorized bank account takeovers, and fraudulent tax filings. Because financial and community development records often link an individual's personal identity directly with their banking or employment status, the illicit exposure of this data creates an immediate and pervasive threat to the financial security and privacy of every affected person. Under both Massachusetts data privacy statutes and broader consumer protection frameworks, organizations like the National Council for Community Development, Inc. have a strict legal duty to implement and maintain robust, reasonable administrative, physical, and technical safeguards to protect confidential consumer and participant data. The occurrence of a data breach of this magnitude serves as a strong indicator of potential negligence, suggesting that the organization may have failed to adhere to industry-standard cybersecurity protocols, such as timely software patch management, multi-factor authentication enforcement, or adequate network monitoring. Such failures directly breach the implied and explicit obligations businesses have to safeguard the private information entrusted to them. Receiving a formal data breach notification letter from Grow America is an official admission that your confidential information was compromised due to inadequate data security practices. Legally, this notification establishes the necessary standing for affected individuals to participate in a class action lawsuit aimed at holding the organization accountable. You do not need to prove that you have already suffered actual financial loss or identity theft to take legal action; simply having your private data exposed creates a compensable injury under the law. Our firm is investigating this matter on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.