PCA Data Breach

PCA detected unusual activity in its network on July 25, 2025 and began an investigation with external forensic specialists. The review determined that unauthorized activity occurred between June 11 and July 25 and that certain information may have been acquired. The organization completed its review of the affected files on February 26, 2026.

The information varies by person. The official notice lists names, addresses, dates of birth, medical diagnosis and treatment information, health insurance information, Social Security numbers, financial account information, and state identification information as possible categories. Not every data element applied to every person.

The organization says it mailed notice letters to affected people for whom it had valid addresses and reviewed and strengthened its data-security policies and procedures. People who did not receive a letter but want to determine whether they were affected, or who have questions about the incident, can use the dedicated assistance line in the official notice.

Notice recipients should rely on their individual letters for their specific data scope. Credit reports, financial accounts, health-insurance statements, and medical bills can be monitored for unfamiliar activity. If a Social Security number or financial information was involved, free credit-freeze and fraud-alert options may be considered, and unexpected messages should be verified through PCA's official contact channel.