On February 2, 2026, Progress Foundation discovered that employee W‑2 forms were inadvertently disclosed to an unauthorized actor. According to the notice, there is currently no indication of unauthorized activity on Progress Foundation’s systems; however, the organization is notifying impacted individuals out of an abundance of caution.
Upon learning of the disclosure, Progress Foundation initiated a diligent investigation to determine the nature and scope of the incident. The organization reviewed relevant data, confirmed the categories of information involved, secured its environment, and began notifying potentially affected individuals. Progress Foundation also reported the matter to federal law enforcement and the Internal Revenue Service (IRS).
Progress Foundation, established in 1969 in San Francisco, is a non-profit providing community-based, non-institutional, acute residential treatment for mental health crises. Operating under a “social rehabilitation” philosophy, it offers a homelike alternative to hospitals, with services focusing on recovery and reintegration.
In this incident, W‑2 documents were disclosed outside the organization, potentially exposing personal data associated with employees.
Following the incident, Progress Foundation stated that it continues to review and enhance policies, procedures, and processes for storing and accessing personal information to reduce the likelihood of a similar event. Impacted individuals are being offered complimentary credit monitoring services through Epiq for a specified period, along with identity protection features such as SSN monitoring, dark web monitoring, change‑of‑address monitoring, identity restoration assistance, and up to $1,000,000 in identity theft insurance (jurisdictional limits and policy terms apply).
If you received a Notice related to this Progress Foundation incident, it confirms that your personal information may have been involved.
What information is involved in the Progress Foundation Data Breach?
Compromised information may include:
First Name
Last Name
Social Security Number
W2
Personally Identifiable Information (PII) includes data used to identify you — such as your name and Social Security number. When PII is exposed, it can be leveraged to commit identity theft, tax fraud (e.g., filing false returns), financial fraud, or other misuse. Given the sensitivity of W‑2 data, impacted individuals should act promptly to protect themselves.
A specific subset of PII is Protected Health Information (PHI), which includes medical and health insurance data. PHI is protected under both federal and state privacy laws, including HIPAA and related state statutes. When PHI is exposed in a data breach, it can be used in conjunction with other personal data to commit identity theft, medical fraud, and insurance fraud.
If your information was involved in this data breach, you should monitor your accounts and credit reports for any suspicious activity and take advantage of your free annual credit reports, while also enrolling in the complimentary Epiq credit monitoring and identity protection services provided by Progress Foundation for the designated coverage period. It is also advisable to consider placing a fraud alert or credit freeze with Equifax, Experian, and TransUnion, and to report any suspected identity theft to law enforcement and the FTC through IdentityTheft.gov—obtaining documentation such as a police report if fraud occurs. Additionally, if you suspect tax‑related identity theft, you should promptly contact the IRS and consider obtaining an Identity Protection PIN to help prevent fraudulent tax filings.
Residents of California benefit from enhanced privacy protections under the California Consumer Privacy Act (CCPA), which grants additional rights related to the collection, storage, and protection of personal information. California residents may also have additional legal remedies depending on the nature of the compromised data.
If you received a Notice related to the Progress Foundation incident, your personal and tax‑related information may be at risk.
Contact the Data Breach Lawyers at Emery | Reddy, PC for a Free Case Review today.