Almeida Law Group is investigating a data breach at Community Connections. The breach occurred on March 18, 2026, and was discovered on March 20, 2026. If you were affected, contact Almeida Law Group.
About Community Connections
Community Connections is a not-for-profit healthcare organization based in Washington, D.C., and is described as the largest not-for-profit mental health agency in the District. Founded in 1984, it provides behavioral health treatment, addiction services, residential and supportive housing, homeless outreach, primary health care coordination, and trauma-informed care for marginalized individuals, families, youth, and children. Because the organization handles sensitive health, financial, and identifying information as part of its services, a breach of its systems carries significant risk for the people it serves.
What Happened?
Community Connections was listed in a Maine Attorney General filing reporting an external system breach — specifically, a hacking incident. A forensic investigation determined that unauthorized access to Community Connections’ systems occurred between March 18 and March 20, 2026, and was discovered on March 20, 2026. The investigation concluded on May 29, 2026, when the organization finalized the list of individuals to notify. Notification letters were mailed to affected individuals on June 3, 2026, approximately 75 days after discovery. A total of 20,879 people were affected. The data potentially compromised includes full name, address, date of birth, Social Security number, medical information, health insurance information, and financial information. Community Connections is offering 12 months of complimentary credit monitoring and identity theft protection services through Cyberscout, a TransUnion company.
This is notably the second data breach at Community Connections within approximately 18 months. A prior breach, discovered October 21, 2024, and disclosed around August 2025, affected 20,876 individuals and involved a similar set of data types, including names, addresses, dates of birth, Social Security numbers, financial information, health insurance details, and medical information. Dapeer Law, P.A. has been publicly investigating a potential class action related to that earlier incident. No filed class action has been identified for the current March 2026 breach as of this writing, though the recurrence of a breach at the same organization in such a short period may prompt further legal scrutiny.
Key Facts at a Glance
- Company or Organization: Community Connections
- Industry: Healthcare / Behavioral Health (nonprofit)
- Location: 801 Pennsylvania Ave SE, Washington, DC 20003
- Incident type: External system breach (hacking)
- Date of breach: March 18, 2026
- Date breach discovered: March 20, 2026
- Date of consumer notification: June 3, 2026
- Total persons affected: 20,879
- Identity theft protection offered: Yes — 12 months of credit monitoring and identity theft protection through Cyberscout, a TransUnion company
- Prior breach: Yes — breach discovered October 21, 2024, affecting 20,876 individuals; disclosed approximately August 2025
- Litigation status: Dapeer Law, P.A. investigating potential class action related to the prior 2024 breach; no filed lawsuit identified for the March 2026 incident
- Source: Maine Attorney General Filing; ClaimDepot – Prior Breach; JoinTheCase – Lawsuit Investigation
What Should You Do?
If you received a notice from Community Connections, enroll in the complimentary 12-month credit monitoring and identity theft protection offered through Cyberscout before any enrollment deadline stated in your notice. You should also place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your financial accounts closely for any suspicious activity. Request your free annual credit reports at AnnualCreditReport.com and review them carefully. If you believe your information has already been misused, visit IdentityTheft.gov for step-by-step recovery guidance. Because medical and health insurance information was involved in this breach, also review any Explanation of Benefits statements from your insurer and check your medical records for services you did not receive.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
