The Friendship House data breach

What we know

The Friendship House operates as a community-focused healthcare and residential care provider in Nebraska, delivering critical support services, behavioral health programs, and assisted living solutions to vulnerable populations. Because of the comprehensive nature of its care model, the organization maintains exceptionally detailed records on the individuals it serves. This includes not only daily administrative and contact information, but also deeply private medical histories, psychological evaluations, treatment notes, insurance details, and social security numbers necessary for billing, state program compliance, and medical coordination. The sheer volume of protected health information and personally identifiable information stored within their digital ecosystem makes The Friendship House an attractive target for malicious cyber actors seeking to exploit high-value personal data. In 2025, The Friendship House officially reported a significant security incident to the Nebraska Attorney General, alerting patients, residents, and staff that an unauthorized party had infiltrated their network infrastructure. Incidents impacting specialized healthcare and residential care facilities typically involve sophisticated cyberattacks such as ransomware deployment, unauthorized database access, or vulnerabilities introduced through third-party vendors and electronic health record management systems. Once inside the perimeter, unauthorized actors frequently maintain undetected dwell time, allowing them to systematically exfiltrate massive quantities of confidential files before security teams detect the anomaly and initiate containment protocols. The exposure resulting from this incident encompasses a dangerous combination of sensitive categories, including full names, dates of birth, Social Security numbers, detailed medical diagnosis and treatment records, health insurance information, and financial data used for care billing. The compromise of this specific data creates severe, long-term risks for victims. Unlike a stolen credit card that can be easily replaced, immutable identifiers like Social Security numbers and deeply intimate medical histories cannot be changed. This exposes victims to sustained threats of medical identity theft—where fraudsters utilize stolen insurance or treatment details to obtain care—as well as sophisticated financial fraud, targeted phishing schemes, and tax refund fraud that can impact individuals for years after the initial breach. Under federal and state law, organizations entrusted with sensitive health and personal data are held to stringent legal standards regarding cybersecurity and consumer privacy. As a healthcare and residential service provider, The Friendship House is bound by the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, alongside Nebraska state data protection statutes. These regulatory frameworks mandate the implementation of robust administrative, physical, and technical safeguards—such as advanced encryption, multi-factor authentication, continuous network monitoring, and regular vulnerability assessments—to prevent unauthorized data exfiltration. The occurrence of a successful breach of this magnitude strongly suggests that systemic vulnerabilities existed within the organization's security posture, raising serious questions about whether adequate protective measures were maintained. Receiving an official data breach notification letter from The Friendship House serves as a formal legal acknowledgment that your confidential information was compromised due to corporate negligence. For affected individuals, this notification establishes the necessary legal standing to participate in a class action lawsuit aimed at demanding accountability, securing compensation for mitigation expenses, and forcing institutional improvements in data security practices. Under established legal precedents in data privacy litigation, victims do not need to prove that they have already suffered actual financial loss or identity theft to pursue claims; the mere increased risk of future harm resulting from the exposure is sufficient. Our firm evaluates these cases on a contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.

See every breach reported in Nebraska or read what to do after a ransomware attack.