The Gladney Center for Adoption data breach

What we know

8The Gladney Center for Adoption operates as a prominent adoption agency and child-placing organization, facilitating domestic and international adoptions, foster care placements, and support services for birth parents, adoptive families, and adoptees. Because of the deeply personal nature of its operations, the organization acts as a repository for exceptionally sensitive personal, legal, financial, and medical information. To successfully manage matching processes, background checks, home studies, and legal placement proceedings, the center must collect and maintain comprehensive records regarding biological parents, prospective adoptive parents, and the children themselves. This vast volume of confidential data makes the organization a high-target repository for malicious actors seeking to exploit sensitive dossiers containing intimate life details.

In 2026, 8The Gladney Center for Adoption reported a significant data security incident to the Indiana Attorney General, triggering widespread concern among the families and individuals it serves. While details surrounding the exact mechanics of the infiltration continue to emerge, incidents of this nature typically involve sophisticated cyberattacks such as unauthorized access to legacy databases, third-party vendor compromises within the digital intake ecosystem, or targeted ransomware operations. Organizations operating in the family services and adoption sector often manage complex webs of digital documentation stored across interconnected servers, creating potential vulnerabilities that cybercriminals actively scan for and exploit to harvest high-value personal records.

The exposure resulting from this breach compromises an array of deeply sensitive data categories, each carrying severe implications for the affected individuals. Birth parents, adoptive families, and adoptees now face heightened risks of identity theft, targeted financial fraud, and severe personal privacy invasions. Because adoption records frequently contain comprehensive background checks, historical home addresses, birth certificates, and sometimes detailed social and medical histories, unauthorized disclosure creates unique vulnerabilities. Unlike standard retail breaches where credit cards can be canceled, the exposure of foundational identity documents, legal proceedings documentation, and government-issued identification numbers leaves victims exposed to long-term, systemic identity exploitation and potential extortion.

Under state and federal regulatory frameworks, including the Indiana Disclosure of Security Breaches Act and broader consumer protection standards enforced by the Federal Trade Commission, 8The Gladney Center for Adoption had a strict legal obligation to implement robust administrative, physical, and technical safeguards to protect confidential records. Organizations handling sensitive family law and adoption data are required to maintain rigorous encryption standards, multi-factor authentication, and continuous network monitoring. The occurrence of a data breach of this magnitude serves as a strong indicator that the organization may have failed to uphold these mandatory security protocols, leaving vulnerable networks exposed to avoidable intrusions and failing in its core duty of care to protect client privacy.

Receiving an official data breach notification letter from 8The Gladney Center for Adoption is a formal acknowledgment that your private information was compromised as a result of institutional negligence, and it establishes the legal standing necessary to participate in a class action lawsuit. Under modern data privacy jurisprudence, victims are not required to prove that they have already suffered actual financial loss or identity theft to seek legal recourse; the mere exposure of your private data due to inadequate security is actionable. Our law firm is currently investigating potential claims on behalf of all affected individuals. We handle these complex data breach cases on a contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.

See every breach reported in Indiana or read what to do after a ransomware attack.