Woodfords Family Services Data Breach

On or about April 8, 2024, Woodfords Family Services became aware of a data security incident involving unauthorized access to its computer network and information systems. According to the notice, Woodfords identified suspicious activity within its network that was ultimately determined to be a ransomware attack attributed to the Medusa threat actor group, prompting the organization to immediately secure its systems, notify law enforcement, and commence a comprehensive forensic investigation.

After discovering that the incident may have impacted certain current and former clients, Woodfords worked to contain the incident, secure its network environment, and determine the scope of the unauthorized activity. Forensic specialists were retained, and the organization later engaged data mining experts to assist with identifying the affected individuals and information.

Following this extensive review, Woodfords Family Services began issuing written notification letters on March 27, 2026 to individuals whose information may have been involved in the incident. At this time, Woodfords reports that it has no evidence of misuse, though the investigation confirmed unauthorized access, data staging, and activity consistent with potential data exfiltration.

Woodfords Family Services is a provider of specialized clinical, educational, and behavioral services for individuals with disabilities, headquartered in Westbrook, Maine, and maintains electronic systems containing sensitive personal and medical information.

The breach occurred within Woodfords’ internal computer network and information systems.

Following the incident, Woodfords stated that it continues to strengthen its security infrastructure, review and update internal security policies, and implement additional safeguards to protect against future cyber incidents.

If you received a data breach notification letter from Woodfords Family Services, it confirms that your personal and/or protected health information may have been involved in the security incident.

What information is involved in the Mercer Advisors Inc. Data Breach?

Compromised information may include:

First Name

Last Name

Social Security Number

Driver’s License Number

Financial Account Information

Medical Diagnosis Information

Medial Treatment Information

Health Insurance Information

Your Personally Identifiable Information (PII) includes information that can be used to identify you. Organizations that maintain this information are required by law to safeguard it. When PII is exposed during a data breach, it may be used to commit identity theft, financial fraud, or other forms of misuse.

Much of the information involved in this incident qualifies as Protected Health Information (PHI). PHI includes medical records, insurance data, and other health-related information protected under federal and state privacy laws. When PHI is compromised, it may be used to commit medical identity theft, insurance fraud, or related crimes—often in combination with other personal data.

If your information was involved in a healthcare or social services data breach, one of the most important steps you can take is to carefully review medical bills, insurance statements, and financial accounts for suspicious activity. Impacted individuals should also review the additional guidance provided with their notification letter, including information on credit monitoring services, fraud alerts, credit freezes, and identity theft protection options.

Individuals may have legal rights when organizations fail to adequately safeguard sensitive personal and medical information. These rights vary by state.

If you received a Notice of Data Security Incident related to the Woodfords Family Services data breach, your personal, financial, and medical information may be at risk.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.