Alma Family Services Data Breach: A Hacked Network Server

Alma Family Services reported a data breach to the U.S. Department of Health and Human Services on September 10, 2026. The federal listing classifies it as a hacking or IT incident, names a network server as the location of the affected information and indicates that no business associate, such as an outside vendor, was involved.

Little else is public. Alma has not described when the intrusion happened, when it was discovered or how the attacker got in, and as of October 5, 2026, we found no notice about the incident on its website.

The HHS portal lists breaches of unsecured protected health information that affect 500 or more people, so Alma’s report indicates that health information was involved. The listing does not identify which details, and Alma has not published a list of data types.

That should become clearer once letters arrive. Under HIPAA’s breach notification rule, a provider’s letter to affected individuals must describe the types of information involved, such as whether names, Social Security numbers or diagnoses were included.

Alma Family Services was founded in 1975 in East Los Angeles by parents seeking multilingual, community-based services for families, including those with special needs. Its website says it operates eight mental health outpatient offices in Long Beach, Walnut, Pico Rivera, El Monte and East Los Angeles, and its programs range from substance abuse services to a preschool and an aquatics center.

The HHS listing shows 2,753 affected individuals but does not say whether they are clients, employees or others. Because Alma serves communities across Los Angeles County, many of those affected may live in California. As of October 5, 2026, no sample notice for this incident appeared on the California Attorney General’s data breach list.

Alma has not published a statement about its investigation, the steps it has taken to secure its systems or whether it will offer credit monitoring or identity protection. Organizations usually cover those points in the letters they send to affected individuals.

HIPAA generally requires those letters to go out without unreasonable delay and no later than 60 calendar days after a breach is discovered, unless law enforcement asks for a delay. Alma has not said when it discovered this incident, so public records don’t show when its letters are due.

Until Alma explains what was involved, these precautions cover the most common risks:

• Watch your mail for a letter from Alma. It should say which of your details were involved and whether any monitoring is being offered.
• Check insurance and benefit statements. Claims for visits, prescriptions or services you never received can signal that someone is using your health information.
• Consider a credit freeze as a precaution. Alma hasn’t said whether Social Security numbers were involved, but a freeze at the three national credit bureaus is free and can be lifted when you need credit.
• Be careful with anyone who contacts you about the breach. Fraudsters sometimes use real incidents as cover, so verify the caller or sender with contact information you find on your own.

This overview is not legal advice; a legal professional can walk you through what applies to your circumstances.

Have you received care or other services from Alma Family Services, or are you waiting to learn whether your information was on the hacked server? Wilshire Law Firm is based in Los Angeles, and our award-winning, nationally recognized team handles data privacy claims, including health care breaches that are sometimes litigated as class actions. Talk with a legal professional in a free consultation or free case review; we’re available 24/7, and there are no fees unless you get paid.

Reach out today, and we’ll go over what Alma has told you so far.