Resource Center of Dallas, Inc.

Summary

A health, wellness, and advocacy services provider in North Texas serving the LGBTQIA+ community notified approximately 12,490 individuals about a data security incident in which an unauthorized third party accessed its network over a nine-day window. Third-party cybersecurity professionals were engaged to investigate the suspicious activity, and the subsequent review confirmed that the threat actor accessed or removed files containing personal and protected health information. The compromised data included names, dates of birth, medical information, health insurance information, financial account information, and other identification details, with Social Security numbers exposed for certain individuals. Following the incident, the organization reviewed its privacy and security protocols and implemented additional safeguards to reduce the risk of similar events in the future.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Resource Center of Dallas, Inc., a North Texas-based provider of health, wellness, and advocacy services to the LGBTQIA+ community, experienced a data security incident earlier in 2026 in which an unauthorized third party accessed certain systems within its computer network. Third-party cybersecurity professionals were engaged to investigate suspicious network activity, and the investigation determined that the unauthorized access occurred between February 4, 2026, and February 12, 2026. During this window, the threat actor was able to access or remove files that contained personal and/or protected health information belonging to individuals served by the organization. The incident was disclosed publicly through a notification process that involved contacting 12,490 affected individuals about the exposure of their information.

Following the discovery of the unauthorized access, Resource Center of Dallas undertook a comprehensive review of the files that may have been involved in order to determine the identities of the affected individuals and the specific categories of information that were exposed. The data review process was completed on or around July 2, 2026, at which point the organization confirmed the scope of the compromised data. The information identified as having been accessed or removed included names, dates of birth, medical information, health insurance information, financial account information, and other identification information. For certain individuals, the exposed data also included Social Security numbers. The combination of these data types, particularly the inclusion of Social Security numbers and financial account information for some individuals, indicated that the breach involved highly sensitive personal and protected health information.

In response to the incident, Resource Center of Dallas stated that it took the security of personal and health information very seriously and had implemented many precautions to safeguard such information prior to the event. The organization also indicated that it continually evaluates and modifies its practices to enhance privacy and security. After the incident was identified, the organization reviewed its existing privacy and security protocols and practices, and additional safeguards were implemented to reduce the risk of similar incidents occurring in the future. Notification letters were sent to the 12,490 affected individuals to inform them of the breach and the specific categories of information that may have been involved in the unauthorized access or removal of files between February 4 and February 12, 2026. The organization's response measures, including the engagement of third-party cybersecurity professionals for the investigation and the subsequent review and enhancement of its security practices, were documented in the public notification issued on or around September 4, 2026.

Sources

Sources available to members: 1 source.