Well Child Data Breach: What Families and Students Need to Know

According to a Notice of Cybersecurity Incident posted by Well Child, Inc., the company discovered the incident on June 1, 2026, and determined on June 5, 2026, that certain files had been taken from its temporary file storage server that could contain sensitive personal information. Well Child provides school-based health services — including physicals, vision screenings, telehealth, and school nursing — to students, which is why the affected files relate to student health screenings and assessments.

Well Child reports that it notified federal law enforcement, conducted extensive reviews of its systems, and strengthened its security controls in response. The company posted its public notice on August 4, 2026, and the incident appears on the U.S. Department of Health and Human Services Office for Civil Rights breach portal with a submission date of August 14, 2026, categorized as a hacking/IT incident involving a network server. Details reported at this stage may be refined as the review continues.

In its notice, Well Child states that the files involved included Vision Screening Report Files, Vision Screening Data Files, Available Students Lists, and PEDS (Parents’ Evaluation of Developmental Status) assessment documents. The company reports that the protected health information potentially involved may have included names in combination with dates of birth, medical record numbers, provider names, diagnoses, assessment results, treatment dates, and billing codes.

Well Child also states that, for a limited number of individuals, the information may have included a Social Security number. Because the affected individuals are largely students — many of them minors — and the data includes developmental and health assessment details, families may wish to treat the situation with particular care. Where children’s identifying and health information may have been exposed, there can be a risk of identity theft or medical identity theft that may not surface for years.

Well Child, Inc. is headquartered in Memphis, Tennessee, and delivers preventive health services to students through schools. The individuals potentially affected are likely to be students who received vision screenings or developmental assessments through Well Child’s programs, along with the parents or guardians whose information may appear in related records.

The HHS Office for Civil Rights portal currently lists 500 individuals as affected, a figure that may reflect a preliminary or minimum reporting threshold rather than a final count, and Well Child has not published a total. Families who receive a notification letter from Well Child, or whose child’s school participated in Well Child screenings, may want to review any communication they receive closely.

Well Child reports that it reported the incident to federal law enforcement, conducted extensive reviews of its systems, and strengthened its security controls following the incident. In its public notice, the company encouraged affected individuals to monitor account statements, credit reports, and Explanation of Benefits statements for suspicious activity and errors.

The company’s public notice does not describe an offer of complimentary credit monitoring or identity protection services; instead, it provides information about contacting the three major credit bureaus and placing fraud alerts or security freezes. If any additional services are offered, those details would typically appear in an individual notification letter, so families may want to review any letter they receive carefully.

While Well Child has not reported any known misuse of the information, families may wish to consider a few precautionary steps:

• Review any notification letter closely. It may describe the specific information involved for your child and any resources being offered.
• Consider a credit freeze for your child. Parents and guardians can request a free security freeze on a minor’s credit file with Equifax, Experian, and TransUnion, which can help prevent accounts from being opened in a child’s name.
• Monitor Explanation of Benefits statements. Watch for medical claims or services your child did not receive, which can be a sign of medical identity theft.
• Check your own credit reports. If your information appeared in related records, you are entitled to free annual credit reports at annualcreditreport.com.
• Stay alert to phishing. Be cautious of unexpected emails, calls, or texts referencing the incident or your child’s school health services, and verify communications through official channels before sharing information.

This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.

If your child’s health information or your personal data may have been involved in the Well Child data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.

Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.