The Westchester Institute for Human Development (WIHD) experienced a data breach that occurred between March 23, 2026, and April 14, 2026. The incident was discovered and reported to the U.S. Department of Health and Human Services on August 10, 2026. WIHD publicly disclosed the breach, and notification letters were sent to affected individuals starting September 9, 2026.
An unauthorized party gained access to WIHD’s email environment, which may have exposed sensitive information belonging to approximately 938 individuals. The types of data potentially compromised include names, dates of birth, Social Security numbers, driver’s license numbers, contact information, financial account information, full face photos, medical conditions, medical record numbers, patient account numbers, prescription information, provider information, dates of medical service, health insurance policy numbers, and Medicaid or Medicare numbers. It is currently unclear if the breach impacted individuals in specific US states beyond the general confirmation of US residents.
A class action lawsuit, Cola v. Westchester Institute for Human Development, was filed on May 31, 2023, in the District Court, S.D. New York, with docket number 7:23-cv-04540. It is important to note that information regarding the full scope of the breach or any ongoing legal proceedings may evolve over time.