TriCity Family Services Data Breach (2.5 Thousand People Affected)

The TriCity Family Services data breach affected 2,511 people after an unauthorized actor accessed the network and downloaded files between November 11, 2024, and May 14, 2025.

TriCity Family Services is a nonprofit organization providing counseling and mental-health services across age and income groups in Kane County, Illinois.

What Happened in the TriCity Family Services Breach?

In spring 2025, the organization identified evidence of unauthorized access to its systems, secured its environment, and opened an investigation with an outside cybersecurity firm. The review found that an unauthorized actor accessed the network and downloaded copies of certain files between November 11, 2024, and May 14, 2025.

The official notice does not identify the initial access method, exploited vulnerability, or responsible actor. TriCity specifically says its electronic medical records were not affected and that the impact was limited to information collected at intake.

What Information May Have Been Affected?

Depending on the person, the affected information may have included names, dates of birth, presenting problems, requested treatment, treatment locations, and provider names. The combination is sensitive because it can connect identity with a mental-health context.

The official incident scope does not list Social Security numbers, financial accounts, payment cards, passwords, or complete electronic medical records. Generic credit-protection instructions in the notice should not be treated as evidence that those fields were involved.

How Many People Were Affected?

The U.S. Department of Health and Human Services breach entry dated December 8, 2025, reports 2,511 affected individuals and classifies the event as a Hacking/IT Incident involving a Network Server.

What Should Affected People Do?

Notice recipients should rely on the data scope identified in their own letters and review patient-portal activity, health-insurance explanations of benefits, and medical bills for unfamiliar services, providers, or claims.

Details such as a presenting problem or requested treatment can make targeted fraud more convincing. Unexpected communications using the TriCity name should be independently verified through an official channel without using links or callback numbers in the message.