Volunteers of America Ohio & Indiana data breach

What we know

Volunteers of America Ohio & Indiana is a prominent multi-state human services and non-profit organization dedicated to supporting vulnerable populations, including veterans, individuals recovering from substance use disorders, at-risk youth, and those experiencing homelessness or housing instability. Because of the comprehensive social, mental health, and transitional services they provide, the organization routinely collects and maintains deeply sensitive personal, financial, and medical information. To deliver these critical community programs, Volunteers of America Ohio & Indiana must compile detailed intake records, background details, housing applications, and sometimes private health or financial data for the individuals they serve, as well as comprehensive personnel files, tax records, and direct deposit details for their extensive staff and volunteers.

In 2026, Volunteers of America Ohio & Indiana reported a serious data security incident to the Indiana Attorney General. While non-profit organizations often believe they are flying under the radar of cybercriminals, they are frequently targeted precisely because their extensive human services networks, donor databases, and administrative systems may lack the multi-layered enterprise security budgets of large corporate entities. Incidents of this nature typically involve sophisticated cyberattacks such as ransomware, unauthorized intrusions into internal databases, or third-party vendor compromises that expose networks to unauthorized external actors for an extended duration before detection.

The exposure resulting from a breach at a human services organization of this scale typically compromises a devastating mix of highly sensitive information. Affected individuals often face the unauthorized disclosure of full legal names, dates of birth, Social Security numbers, banking and direct deposit details, home addresses, and private case management or medical intake notes. This combination of data is a goldmine for cybercriminals. Social Security numbers and dates of birth can be utilized for immediate identity theft and fraudulent credit openings, while compromised financial details expose victims to unauthorized account withdrawals and tax fraud. Furthermore, the exposure of private program participation or intake notes introduces severe risks of targeted phishing, extortion, and emotional distress.

As an organization handling vast amounts of confidential personal and financial data, Volunteers of America Ohio & Indiana had strict legal and regulatory obligations to safeguard this information against unauthorized access and disclosure. Under state data protection statutes, the Indiana Deceptive Consumer Sales Act, and common law negligence principles, organizations holding sensitive consumer and employee data are required to implement and maintain reasonable data security measures, including robust encryption, network monitoring, and prompt patching of vulnerabilities. The occurrence of a widespread data breach strongly indicates a potential failure to satisfy these foundational security duties, suggesting that existing safeguards fell well short of industry standards.

Receiving a data breach notification letter from Volunteers of America Ohio & Indiana is a formal admission that your private, sensitive information was compromised due to inadequate data security practices. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the organization accountable. You do not need to wait until you suffer actual financial loss or identity theft to take legal action; the increased risk of future fraud is itself a recognized harm. Our firm handles data breach and class action cases on a strict contingency fee basis, meaning you pay nothing out of pocket, and there are no attorney fees unless we successfully recover compensation on your behalf.

See every breach reported in Indiana or read what to do after a ransomware attack.